Startup Deep Dive : TAC Security — governance red flags shadow its record IPO growth

A Ludhiana teenager who dropped out of college in 2013 to start a one-room cybersecurity shop now runs a company that Mumbai super-investor Vijay Kedia backed with a $65,600 cheque in 2016 and that listed on NSE Emerge in 2024 at a 173.6% first-day pop. Trishneet Arora’s TAC Security says its FY26 revenue crossed ₹57 crore ($5.9 million, at $1 ≈ ₹96.0 as of 18 September 2026, Trading Economics) with a 46.1% profit margin — even as an independent review of its own annual report flagged a customer that once supplied more than 82% of revenue, a managing director’s pay that rose over 233% in a single year, and ₹1.39 crore of routine costs booked as assets rather than expenses.

That gap between the headline growth story and the fine print is the real story of TAC Security (legal name TAC Infosec Limited): a bootstrapped vulnerability-management SaaS business that became India’s first listed pure-play cybersecurity company, then had to prove — quarter after quarter, filing after filing — that its numbers could stand on their own.

Quick facts

What TAC Security does

TAC Security sells ESOF (Enterprise Security in One Framework), a risk-based vulnerability-management platform that scans a company’s servers, applications, cloud accounts and networks for security holes, then ranks each one by a proprietary “Cyber Risk Score” instead of the generic severity ratings most scanners use. The pitch to a chief information security officer is triage: a large enterprise can find tens of thousands of vulnerabilities a year, and no team can patch all of them at once, so ESOF is built to tell them which ones actually matter first. The company also runs ESOF AppSec for web and mobile application testing, and in February 2025 it bought 60% of CyberScope, a Greece-founded firm that audits blockchain smart contracts, to move into Web3 security. Customers span Fortune 500 names, banks and government bodies; the company said it crossed 10,000 combined customers (about 6,500 under the TAC Security brand and 3,500-plus via CyberScope) by April 2026, per its own announcement covered by Security Boulevard.

The origin

Trishneet Arora was born on 2 November 1993 in Ludhiana. By his own and multiple published accounts, his first hack was his father’s computer around 2007 — curiosity rather than malice, but it pulled him toward ethical hacking as a teenager. He wrote his first book, The Hacking Era, in 2013 at 19, self-publishing it before he had any institutional backing, and used the modest royalties and the profile it gave him — talks at colleges and police departments across Punjab — to start TAC Security on 27 February 2013 rather than finish a conventional degree. The founding insight was narrow and, in hindsight, well-timed: Indian banks, police forces and mid-sized companies needed penetration testing and vulnerability assessments, and almost none of the firms selling those services could speak to a boardroom the way Arora could, because he built his name doing it in public through his books and media appearances before he built the company doing it privately for clients.

The struggle years

The company’s own retrospectives are thin on specific setbacks, which is itself notable for a firm this vocal about its later wins — but two are documented with dates. The first is capital: TAC Security ran on service revenue and Arora’s own resources for three years with no outside investor, a long stretch for a security consultancy competing against far better-funded global vendors, until Vijay Kedia wrote a small angel cheque in August 2016. The second is product-market transition: a services business that bills for one-off penetration tests does not compound the way a subscription platform does, and TAC had to rebuild itself around ESOF as a recurring-revenue SaaS product through the late 2010s while continuing to service the consulting clients that paid the bills — a rebuild that shows up in its filings as revenue only reaching ₹5.24 crore for the year ended March 2022, nine years after founding, according to figures in its IPO prospectus reported by Chittorgarh. That is a slow burn for a company that would later grow revenue 88% in a single year once the SaaS model took hold.

The turning point

The clearest before-and-after moment is the IPO. TAC Infosec opened its NSE Emerge SME offering on 27 March 2024 to raise ₹30 crore (28,29,600 fresh shares) at a price band of ₹100–106, according to Chittorgarh’s IPO summary. Retail investors subscribed their portion 433.54 times and the overall issue 281 times, per Business Standard’s coverage of the final subscription day. On 5 April 2024 the stock listed at ₹290 — a 173.6% premium to the ₹106 issue price — and touched ₹304.50 intraday, Business Standard reported. On the “before” side of that day sat a company with FY23 revenue of ₹10.14 crore and profit of ₹5.07 crore (Chittorgarh, citing IPO financials); on the “after” side, per the company’s own account relayed by Inc42, TAC’s customer base of roughly 100 clients pre-IPO more than doubled within months of listing, and by Q1 FY25 (April–June 2024) quarterly revenue had jumped 93.8% sequentially to ₹5.1 crore with profit up 94.4% to ₹2.3 crore. Being India’s first listed pure-play cybersecurity company — a claim repeated by Inc42 and Business Standard independently — gave TAC a credibility and visibility jump that its earlier decade of bootstrapped consulting work never produced.

The money behind it

• August 2016 — angel round, $65,600: Vijay Kedia, the veteran Mumbai stock-market investor, invested within roughly two weeks of meeting Arora and joined the company’s board; Kedia has said publicly the company “performed beyond my expectations” (TAC Security company blog, quoting Kedia; corroborated by BW Disrupt’s report on the round). He held about a 15% stake as of the IPO period.
• 2018 and 2020 — two further private rounds ($500,000 in January 2018 and $1 million in April 2020): reported by funding-tracker compilations (via StartupTalky); named investors for these two rounds were not found in any source opened this session, so they are cited here only as reported amounts, not confirmed backers.
• March 2024 — anchor allocation, ₹8.55 crore: ahead of the IPO, anchor investors including NAV Capital VCC (29.46% of the anchor book), Astorne Capital VCC and Beacon Stone Capital VCC (23.51% each) committed capital on 27 March 2024, per Inc42’s report on the anchor round.
• April 2024 — IPO, ₹30 crore raised: the fresh-issue-only SME IPO on NSE Emerge, lead-managed by Beeline Capital Advisors, was TAC’s only public capital raise to date (Chittorgarh).
• Total disclosed private-plus-public capital raised is small for a company of TAC’s current market value — well under ₹40 crore across all rounds and the IPO combined by the figures found this session — which is consistent with Arora and Kedia together still holding a majority of the company (56.7% combined promoter/investor holding as of March 2026, per NSE shareholding disclosures cited by Screener.in and Business Standard). No third-party valuation of the pre-IPO private company was found in any source opened this session, so none is stated here.

How it makes money

TAC runs a software-as-a-service model layered on top of its original consulting roots. Customers pay a subscription for access to ESOF, priced by scope (number of assets scanned, applications tested, users) rather than a simple per-seat fee, plus a consulting layer — manual penetration testing, red-teaming and compliance advisory — that both cross-sells the platform and gives the company services revenue that does not depend on renewal cycles.

• Revenue mix by geography: roughly 70–75% of revenue came from the United States and the remainder mostly from India in FY24 (StartupTalky) and again in Q1 FY25 (Inc42’s CEO interview) — a consistent split across two independent reporting periods.
• Margin structure: FY26 gross margin was reported around the high-40s to low-50s percent range historically (48% cited for FY25 per PTI/Tribune coverage of the AGM), and FY26 EBITDA margin was 53.8% on ₹30.75 crore of EBITDA (NSE filing, 14 May 2026) — unusually high for an Indian SME-listed software company, reflecting a lean, largely automation-led delivery model rather than a large billable-hours workforce.
• The part investors are watching: an independent review of TAC’s FY25 annual report (Dhruv Sahu, Substack, 16 July 2026) found that roughly 72% of the ₹30 crore IPO proceeds remained unutilised and parked in fixed deposits, and that interest income from those deposits materially contributed to reported profit rather than the core security business — meaning a slice of the profit margin is treasury income, not platform economics.
• CyberScope’s contribution: the Web3-security subsidiary added about $1.2 million to group revenue around the time of its February 2025 acquisition, per Inc42’s interview with Arora, and more than 3,000 of the group’s 10,000-plus customers now sit inside CyberScope rather than the core ESOF business.

The numbers

Figures below are consolidated, in ₹ crore, drawn from TAC’s IPO financial disclosures (FY22–FY23, via Chittorgarh) and its post-listing exchange filings (FY24–FY26, via Screener.in and the company’s NSE-filed FY26 results press release, 14 May 2026).

• FY22→FY23: revenue nearly doubled and profit rose more than 8x, the year the ESOF SaaS transition visibly paid off (Chittorgarh, citing RHP financials).
• FY25 (AGM disclosure, October 2025): the company separately reported total income (which includes other income, not just operating revenue) up 172% year-on-year to ₹32.2 crore, EBITDA up 152% to ₹17 crore and net profit up 134% to ₹14.8 crore, per PTI coverage carried by The Tribune and The Wire — figures that differ slightly from the pure “revenue from operations” line because they include other income.
• FY26: PAT margin held at 46.1%, barely down from 46.0% in FY25, even after the company’s tax holiday expired and it began paying tax during the year — a detail the company’s own NSE filing (14 May 2026) highlighted as evidence of underlying operating strength, not just a tax-timing effect.

Where the money comes from

• Geography: the United States supplied roughly 70–75% of revenue in FY24 and Q1 FY25, with India making up most of the rest (StartupTalky; Inc42) — unusual for an NSE Emerge-listed SME, most of which sell domestically.
• Segment split: core ESOF vulnerability-management and application-security subscriptions form the base business; CyberScope’s Web3/smart-contract audit line, added in February 2025, contributed about $1.2 million at acquisition and now carries more than 3,000 of the group’s customers (Inc42; Security Boulevard).
• Customer concentration, historically: per an independent review of TAC’s own RHP and annual-report disclosures (Dhruv Sahu, Substack, July 2026), a single customer accounted for more than 82% of total revenue in one of the company’s reported financial years before its IPO — a concentration level the company has since diluted by adding thousands of smaller accounts post-listing, though no source opened this session gives an exact current top-customer share.
• The surprise: for a company marketed around an Indian founder’s story and an NSE-Emerge listing, the bulk of the cash TAC actually collects comes from outside India, and a meaningful slice of its post-IPO customer count now sits inside an acquired Greek subsidiary rather than the original ESOF product.

The risks

• Customer concentration and acquisition-led growth: the historical 82% single-customer dependency (Substack review of RHP/annual report disclosures, July 2026) shows how exposed a small SaaS vendor can be to one account; the more recent growth strategy of buying customer bases (CyberScope) rather than growing the core platform organically carries its own integration and retention risk if acquired customers churn after the deal.
• Governance and disclosure gaps flagged by outside review: the same July 2026 analysis found a director loan of ₹7.45 lakh that it said breached Section 185 of the Companies Act, a trading window left open during an ESOP-related board meeting, three CFO changes and a Company Secretary change within roughly a year, and delayed regulatory filings — the kind of control weaknesses that matter more, not less, as a company scales its investor base. TAC has separately stated that SEBI’s related-party-transaction disclosure norms do not apply to it because it trades on the NSE Emerge SME platform rather than the main board, which is accurate as a rule but also means a normal governance safeguard larger listed peers must follow does not bind TAC.
• Revenue quality versus reported profit: TAC’s own FY25 annual report flagged recoverability of trade receivables as a Key Audit Matter, with collection depending on contractual milestones and customer acceptance rather than straightforward invoicing; separately, about 72% of IPO proceeds sat in fixed deposits as of the July 2026 review, with the resulting interest income contributing to reported profit — meaning part of TAC’s margin story is treasury yield rather than platform economics, and investors reading only the headline PAT growth could miss that distinction.

The takeaway

TAC Security’s story is really two different companies stitched together by one founder’s timeline. The first decade was a slow, self-funded consulting business that a college dropout built by writing books and giving talks before he had paying enterprise clients — proof that a strong personal brand can substitute for capital in a trust-heavy business like security, if you are patient enough to let it compound. The second act, from the 2016 Kedia cheque through the 2024 IPO to the CyberScope acquisition, is a much faster, headline-friendly growth story that a small-cap public market rewarded generously, at a listing pop and valuation multiple that a comparably-sized private SaaS company would rarely command. The lesson for anyone studying it is not that fast growth and governance shortcuts always go together — plenty of scaling companies have both without one causing the other — but that the two need to be checked separately: a growth rate this good deserves the same scrutiny of receivables, related-party dealings and where the profit actually comes from that a slower, less exciting company would get by default, precisely because a hot growth story is the easiest place to stop looking.

Frequently asked questions

Is TAC Security the same company as TAC Infosec Limited?

Yes. TAC Security is the brand name; the listed legal entity on NSE Emerge is TAC Infosec Limited, founded by Trishneet Arora.

Is TAC Security a listed company?

Yes. It listed on the NSE Emerge SME platform on 5 April 2024 at ₹290 per share, a 173.6% premium to its ₹106 IPO issue price (Business Standard, Chittorgarh).

Who are TAC Security’s major shareholders?

Founder Trishneet Arora holds the largest stake (reported around 74% pre-dilution), and investor-director Vijay Kedia holds roughly 15%; combined promoter and promoter-group holding stood at 56.7% as of the March 2026 NSE shareholding disclosure.

What was TAC Security’s revenue in its latest full financial year?

₹57.26 crore for the year ended March 2026, up 88% year-on-year, with profit after tax of ₹26.35 crore, per the company’s results filed with NSE on 14 May 2026.

What risks have been raised about TAC Security’s financials?

An independent review of its RHP and FY25 annual report (Dhruv Sahu, Substack, July 2026) flagged historical customer concentration above 82% with a single client, governance lapses including a Companies Act Section 185 issue and rapid CFO turnover, and roughly 72% of IPO proceeds sitting unused in fixed deposits, whose interest income padded reported profit.

Sources

Figures are as of September 2026. Currency converted at $1 ≈ ₹96.0 as of 18 September 2026 (Trading Economics).

• Chittorgarh, “TAC Infosec IPO Date, Price, GMP, Review, Details” (accessed September 2026)
• Business Standard, “NSE SME: TAC Infosec encrypts success with stellar debut” (5 April 2024) and IPO subscription coverage (2 April 2024)
• Inc42, “Vijay Kedia-Backed TAC Security Secures INR 8.55 Cr From Anchor Investors Ahead Of IPO” (March 2024)
• Inc42, “TAC Infosec CEO On The Post-Listing Acquisition Playbook, AI Opportunity” (2025/2026)
• Inc42, “TAC Infosec Initiates US Listing Of Subsidiary CyberScope” (2026)
• Screener.in, TAC Infosec Ltd consolidated financials (accessed September 2026)
• NSE India corporate filing, “TAC InfoSec Emerges Among the World’s Most Profitable Cybersecurity Companies with 53.8% EBITDA Margin in FY26” (14 May 2026)
• PTI/The Tribune/The Wire, “TAC InfoSec Limited AGM Highlights: Reports 172% Surge in FY25 Revenue” (October 2025)
• StartupTalky, “TAC Security Success Story” (accessed September 2026)
• BW Disrupt, “TAC Security Closes Pre-Series ‘A’ Funding from Prominent Business Investor – Vijay Kedia”
• TAC Security company blog, “TAC Security performed beyond my expectations: Vijay Kedia” (accessed September 2026)
• Security Boulevard, “News Alert: TAC Security surpasses 10,000 customers” (April 2026)
• Dhruv Sahu (Substack), “The Questions TAC Infosec’s Annual Report Couldn’t Answer” (16 July 2026)

Found an error? Write to us and we’ll correct it in the open, dated, on the piece.