Industries
Cyber security for agriculture & social welfare.
Beneficiary registries and direct benefit transfer platforms serving crores of citizens.
What is actually going on here
Welfare technology has a failure mode that most systems do not: exclusion. If a bank's authentication fails you are inconvenienced. If a welfare scheme's authentication fails, someone does not receive a subsidy or a pension they depend on. Availability and correctness here are not service levels, they are outcomes for people with no alternative.
These are among the largest systems in the country by user count, with beneficiaries in the crores, and they connect to Aadhaar authentication, direct benefit transfer and land records. The data is unusually complete: identity, land holding, income and family composition in one place.
We have delivered on national and state scale schemes with beneficiary counts in the crores. What we watch for hardest is not the dramatic breach but the quiet defect that stops a subset of people being paid.
Who regulates you, and what they want
Tick the ones that bind you and we will pull together the evidence each of them actually asks for. Nothing is sent anywhere.
Pick one or more above to see what they expect of you.
What goes wrong in this sector
Beneficiary database compromise
Identity, land holding, income and bank details together, on a scale that makes the dataset valuable for fraud far beyond the scheme itself.
Direct benefit transfer diversion
Manipulation of bank account mappings so payments go elsewhere. Often insider assisted, sometimes at very small scale per record and very large in aggregate, which is exactly what evades review.
Aadhaar authentication misuse
Where the scheme is an AUA or KUA, misuse of the authentication path by an operator or sub-agent. Audit trails and rate anomaly detection are the controls that matter.
Ghost beneficiary injection
Fictitious records added at the enrolment layer, drawing benefits indefinitely. This is a data integrity attack and it needs analytical detection rather than perimeter security.
How we work in this sector
- 01
Protect against exclusion first
We test for failure modes that wrongly deny a benefit, not only for those that wrongly grant one. Both are defects and only one of them usually gets attention.
- 02
Test at real scale
Enumeration, rate limits and bulk extraction paths, because a scheme with crore-scale beneficiaries fails differently from a system with thousands.
- 03
Audit the authentication path
Full review of the AUA or KUA implementation, including operator behaviour, which is where misuse actually originates.
- 04
Detect integrity attacks
Analytical review for ghost beneficiaries and account mapping anomalies, since neither shows up in conventional security testing.
What we actually keep finding here
Not a threat list copied from a report. These are the patterns that recur across our own engagements in this sector, with an honest note on how often. Where we do not have a precise number we say so rather than inventing one.
- Most engagements
Defects that wrongly deny a benefit
The failure mode that matters most here and the one least often tested for. A breach is serious; a person not receiving a pension they depend on is also serious and far more likely.
- Often
Bank account mappings alterable at small scale
Insider assisted diversion, tiny per record and very large in aggregate, which is exactly what evades threshold based review.
- Often
Authentication misuse by operators and sub-agents
Not a break in the UIDAI infrastructure but misuse of a legitimately held AUA or KUA licence, visible only in audit trails nobody reviews.
- Most engagements
Ghost beneficiaries detectable only analytically
Duplicate identity patterns, improbable demographic clusters and bank accounts shared across unrelated beneficiaries. Conventional penetration testing will never find these.
Questions worth asking any provider in this sector
Including us. If a provider cannot answer these clearly, that tells you more than any capability slide will. We would rather you asked them than took our word for it.
- 1
Will you test for failure modes that wrongly deny a benefit, not only those that wrongly grant one?
- 2
How will you work against production without any risk to live payments?
- 3
Will you audit the AUA or KUA authentication path including operator behaviour?
- 4
Can you do analytical detection for ghost beneficiaries and account mapping anomalies?
- 5
Will your reporting satisfy the sponsoring ministry's audit format?
What we deliver in this sector
- Beneficiary registry security audit
- Aadhaar AUA/KUA compliance
- Direct benefit transfer flow testing
- Large scale data privacy assessment
- Mobile and field application testing
- Fraud and duplication risk review
- CERT-In audit and certification
- Continuous vulnerability management
Proof
Securing the data of one crore women under Subhadra Yojana
Work in this sector
Named engagements where the client has agreed to be named, and anonymised ones where they have not, which is most of them. Named references are available under NDA.
- Government / Agriculture
Krushak Odisha: CERT-In cyber security audit
Security audit of the farmer identity and benefit-delivery registry for the state of Odisha.
State farmer registry
- Client withheld
Agriculture subsidy scheme, enrolment integrity
- Scope
- Enrolment layer reviewed analytically for fictitious records drawing benefits.
- What we found
- Improbable demographic clusters and land holding records duplicated across unrelated beneficiaries.
- Outcome
- Enrolment validation tightened and a periodic analytical review added to the scheme's audit cycle.
- Client withheld
State welfare scheme, disbursal integrity
- Scope
- Read-only against production, with analytical review alongside conventional testing.
- What we found
- Bank account mappings alterable at a scale small enough to evade threshold review, and duplicate identity patterns.
- Outcome
- Change controls added on account mapping, and anomaly detection introduced for shared accounts across unrelated beneficiaries.
- Client withheld
Scheme operator, authentication audit
- Scope
- AUA and KUA implementation reviewed including operator behaviour, not only the technical path.
- What we found
- Authentication volume anomalies at specific operator terminals that no one was reviewing.
- Outcome
- Rate anomaly detection added, audit trail review scheduled, and two terminals investigated.
Questions we get asked in this sector
Can you test without risking live benefit payments?
Yes, and it is the constraint everything else is designed around. We work read-only against production and use a masked replica for anything active. No test of ours will stop a payment reaching someone.
How do you find ghost beneficiaries?
Analytically rather than by penetration testing. Duplicate identity patterns, improbable demographic clusters, bank accounts shared across unrelated beneficiaries and enrolment velocity anomalies. It is a data exercise, and it needs the scheme's cooperation to interpret the results fairly.
Does DPDP apply to a government welfare scheme?
The exemptions are narrower than most departments assume. Certain state functions are exempt from parts of the Act, but not from the obligation to secure the data, and not in a way that helps if there is a breach. We advise assuming the duty applies.
We are audited by several agencies already. Does this duplicate that?
It should not, and we scope explicitly to avoid it. Financial and performance audits ask different questions from a security audit. Where an existing audit already evidences a control we reference it rather than repeating the work.
Not sure where to start?
Book a 30-minute call with a senior engineer. We will walk through your current posture, the frameworks that bind you, and what a realistic programme looks like.