Sattrix Information Security is a cybersecurity company built on a simple idea: that protecting a business from digital threats should mean removing the risk entirely, not just selling software to manage it. Founded in 2013 in Ahmedabad and listed on the BSE in 2024, the company has spent more than a decade expanding from a local service provider into a global operation with a presence in India, the USA, the UAE, and Malaysia. The recurring approach that explains everything else is a “service-first mindset” - it designs, builds, and runs security operations for clients, and then develops its own technology products based on what it learns from the front lines, rather than the other way around. # Business segments A single cybersecurity engine that spans managed operations, consulting, infrastructure management, and proprietary software - all built around the same practitioner-led, service-first model. ## 1. Managed security operations: an outsourced cybersecurity department **The company acts as a round-the-clock, external security team for enterprises, monitoring systems, hunting threats, and responding to incidents so clients do not have to build this capability themselves.** - **24x7 eyes on screen** - its Security Operations Centre (SOC) runs continuously, managing and monitoring cloud, hybrid, or on-premises security setups from a dedicated 40-seat-per-shift facility inside a new 10,000 sq. ft. corporate office. - **Broad coverage, one contract** - managed services span vulnerability patching, endpoint detection and response (catching malware on laptops and servers), incident response, help-desk support, and compliance reporting, which means a client can outsource most of its daily security workload to a single provider. - **Recurring revenue built on retention** - the company earns from ongoing managed-service contracts and subscription renewals, with nine clients of more than three years and ten of more than five years, reflecting high renewal rates and growing spend from existing customers. - **Process rigour as a selling point** - every engagement follows a structured sequence from requirement gathering through design, deployment, testing, and ongoing support, and the operation holds an ISMS certification (a formal information-security management standard) covering its SOC, assessments, and hybrid IT services. ## 2. Cybersecurity assessment and consulting: finding the cracks before an attacker does **The company stress-tests client defences by simulating real attacks, hunting for vulnerabilities, and then advising on what to fix - the diagnostic engine that often feeds the managed-services relationship.** - **Attack simulations, not just checklists** - penetration testing and red-teaming exercises use the same techniques as malicious hackers to see whether an organisation’s defences hold, while anti-phishing campaigns send controlled fake emails to measure how many employees click. - **From finding flaws to fixing them** - vulnerability assessments map the risks across a client’s entire digital system, and the technology consulting practice then helps design, implement, or upgrade the solutions needed, covering everything from product procurement to custom integration and API development. - **Product sales with a service wrapper** - when the consulting engagement recommends specific tools - such as SIEM (security information and event management), privileged access management, or single sign-on - the company can supply the software licences and recognise the revenue when risk and title transfer to the customer. ## 3. IT infrastructure and hybrid IT: keeping the plumbing secure **Beyond pure cybersecurity, the company manages the underlying IT infrastructure - on-premise hardware, cloud environments, and the help desks that support them - so that security and operations are handled under one roof.** - **Technical assistance as a business line** - a dedicated managed-IT unit provides end-to-end support, including daily administration, health checks, configuration reviews, and patch upgrades for IT and security products. - **Hybrid means both worlds** - the company delivers on-premise and cloud infrastructure services, giving clients flexibility for agility, compliance, or efficiency reasons, rather than forcing them into one model. - **OEM partnerships supply the toolkit** - relationships with Palo Alto Networks, Splunk, Google, Liongard, and ESET (for which Sattrix runs a technical assistance centre and is an official detection-and-response partner in India) allow the company to resell, implement, and support third-party products alongside its own services. ## 4. Newevol: the in-house technology backbone **The company built its own security-analytics platform - combining SIEM, SOAR (security orchestration and automated response), and user-behaviour analytics - which its SOC teams use daily and which it also licenses to other enterprises and managed-security providers.** - **Built by practitioners, not just developers** - Newevol was developed from 2018 onward by SOC analysts and engineers with frontline experience, designed to replace fragmented tools with a single system that correlates telemetry and orchestrates responses. - **A feedback loop that competitors lack** - because the company’s own service-delivery teams use the platform in live operations, the software team receives real-time input on what works and what needs improvement, creating a “service-product” synergy that few managed-security providers globally can replicate. - **Reducing dependence on third parties** - owning the technology stack cuts reliance on external tools such as Splunk, QRadar, and ArcSight, and the platform is sold as a standalone licence or SaaS subscription to enterprise SOC teams and channel partners including distributors and system integrators. ## 5. Software development and consultancy: a bolt-on via acquisition **Through its wholly owned subsidiary Sattrix Software Solutions, acquired in February 2026, the company added a small software-development practice serving e-commerce, retail, education, and healthcare clients.** - **Bought, not built from scratch** - the subsidiary was acquired via a share swap from the same promoters who control Sattrix, bringing in capabilities in robotic process automation, artificial intelligence, big-data analytics, and enterprise mobility. # Group structure and partners **The company operates through a parent entity in India, three wholly owned subsidiaries across the US, UAE, and India, and a growing network of joint ventures that act as local delivery vehicles in new geographies - all supported by a channel-first distribution strategy.** - **Parent and listed entity** - Sattrix Information Security Limited is headquartered in Ahmedabad, listed on the BSE SME Exchange since June 2024, and promoter-held by Ronak Gajjar (55.5%) and Sachhin Gajjaer (19.5%) following the subsidiary acquisition. - **Joint ventures as market-entry vehicles** - a 51:49 JV in Malaysia (formed November 2024) targets South East Asia; a 75:25 JV in Spain (MoU signed June 2025) targets the European Union; and a 44%-held US JV, World Tech Nexus Corporation (MoU signed July 2025), aims to distribute cybersecurity solutions and later build a consultancy platform with Tier-1 vendors like Microsoft, Oracle, and AWS. - **Channel-first go-to-market** - the company sells through channel partnerships, OEM licensing, white-label arrangements for regional managed-security providers, and authorised distributors (including a UAE-based distributor for Newevol), alongside direct sales to enterprises and governments.