Rapid BLE/firmware security remediation that gets India's budget EV OEMs' apps reinstated and their BMS breach-proof.

1. MeitY has an active investigation and asked Google and Apple to remove at least seven apps, creating a hard deadline and budget for remediation that did not exist a month ago.
2. Named, independently verified OEMs (Yatri, Mayuri, Vande Bharat, City Life) give a concrete, reachable first customer list rather than a hypothetical market.
3. Because the vulnerable firmware is shared white-label software across many OEMs, one remediation product can be resold to the entire affected segment rather than needing custom engineering per customer.
4. The pain is acute and human, not abstract: riders whose livelihood depends on these vehicles were physically stranded, which raises reputational urgency for OEMs beyond pure compliance risk.

Catalyst. MeitY's active investigation and the Google/Apple app removals give named OEMs an immediate, budgeted, and time-boxed reason to pay for remediation instead of treating security as a someday project.

A security engineering studio that runs a rapid BLE/firmware penetration test against an OEM's BMS and companion app, ships a patched firmware access-control layer (pairing authentication, command signing, rate limiting) within days, and produces a compliance dossier formatted for MeitY and app-store reinstatement review. After the emergency engagement, OEMs subscribe to ongoing firmware monitoring and pre-release security testing so future releases do not reintroduce the same class of vulnerability. Over time, the same hardened firmware module is offered directly to the white-label BMS vendors as a licensable reference stack, so new OEM customers inherit the fix by default instead of needing a bespoke engagement.

What's different. Generalist cybersecurity firms do not know the BLE pairing quirks or BMS command protocols specific to budget Indian EV firmware stacks, and the original white-label vendors cannot credibly self-certify their own fix to a regulator. This studio combines automotive-specific firmware pentesting with a regulator-ready compliance dossier format, letting an OEM go from app-store takedown to reinstatement in days. The reference-firmware licensing model then lets the same fix propagate to every OEM using the same white-label vendor, turning a single remediation engagement into a distribution channel across the entire budget EV segment.

Jobs to be done

flowchart LR
  MeitY[MeitY investigation flags app] --> Takedown[App removed from stores]
  Takedown --> OEM[Budget EV OEM CTO]
  OEM --> Audit[Rapid BLE/firmware pentest]
  Audit --> Patch[Patched access-control firmware]
  Patch --> Dossier[Compliance dossier for MeitY/app stores]
  Dossier --> Reinstated[App reinstated, riders unblocked]
  Patch --> Monitoring[Ongoing monitoring subscription]
  Monitoring --> Vendor[Licensed to white-label BMS vendors]

Executive takeaways

• This is a compliance-speed market, not a generic cyber market: MeitY-linked app removals and app-store rules turn weak BLE access control into a distribution outage for OEMs, not just a QA bug [1][2][13][14].
• The reachable beachhead is the long tail. In Jan-May 2026 the top three e2W OEMs sold 515,458 of 774,924 high-speed units, leaving a visible residual 259,466 units before low-speed e2Ws are even counted [23].
• Buyer pain is operational and human: remote shutdowns strand working drivers, while fleets already report false BMS positives and downtime from weak diagnostics [1][3][31][32].
• Most adjacent competitors sell enterprise automotive cyber platforms or generic IoT pentests; few are optimized for India-local BLE/BMS remediation plus regulator-ready evidence [77][78][79][89].
• The strategic upside is supplier leverage: once one secure reference stack exists, the same fix can spread across multiple OEMs using shared tooling and BMS protocols [1][37][100].

Market definition

The initial market is emergency remediation, secure-update hardening, and recurring firmware security assurance for India's long-tail connected EV OEMs and the shared-stack suppliers behind them. Two-wheelers already sit in more than 60% of Indian households, which explains why even a narrow EV slice can matter commercially at Indian scale [21]. The visible high-speed e2W market already leaves a large residual beyond TVS, Bajaj, and Ather, while public Vahan-based analysis explicitly excludes low-speed e2Ws where white-label electronics are common, so the practical exposure is likely broader than the visible high-speed slice [23][29][41].

Customer and buyer

The first buyer is usually the founder/CTO or engineering head at a budget OEM because the failure spans firmware triage, app availability, dealer onboarding, and rider downtime. The second buyer is the BMS/connectivity supplier, which can remediate once and roll a secure build across many OEM licensees using the same tools and protocols [1][2][3][37][95].

Buying triggers

• A MeitY notice, viral incident, or app-store takedown that blocks new activations and forces an immediate remediation sprint. [1][2][3]
• Repeated field failures, false BMS alarms, or weak diagnostics that make fleets and dealers question the stack even before a regulator acts. [31][32][37]
• Cybersecurity or software-update questions appearing in homologation, partner diligence, or OTA release reviews. [8][9][41][95]

Willingness to pay

OEMs in this segment are price sensitive, but the pain is interruption driven rather than compliance theatre: remote shutdowns strand working drivers, and weak diagnostics already create avoidable downtime. That supports a short fixed-fee emergency remediation purchase when tied to app reinstatement or avoided dealer/fleet disruption, while recurring monitoring will be harder unless it bundles release testing and supplier coordination [2][3][29][30][31]. [2][3][29][30][31]

Category dynamics

Growth signal ~38.6% implied YoY run-rate for high-speed e2W registrations if Jan-May 2026 pace holds versus CY2025 volumes

Validation signals

• MeitY-linked takedowns prove the problem is urgent enough to trigger distribution intervention.
• FAME II had already supported 14.35 lakh e-2Ws and 1.65 lakh e-3Ws by June 2025, so even a narrow security wedge sits on a large installed base.
• Ather’s public vulnerability disclosure program shows Indian EV OEMs already understand third-party security intake.
• Vecmocon’s Battery Buddy notes show flashing, PIN protection, and board support are live operational workflows, not theoretical asks.
• Fleet analytics vendors are already quantifying false BMS positives and uptime gains, which gives buyers an ROI language beyond pure compliance.

Regulatory & technical constraints

• App-store and CERT-In obligations mean any incident may require legal and reporting process, not just a firmware fix.
• Heterogeneous boards and mixed CAN, UART, and RS485 paths make a reusable lab rig mandatory.
• A remediation without supplier cooperation may stall at firmware signing, OTA, or flashing stages.
• Formal AIS-189 and AIS-190 adoption could change customer evidence requirements mid-sales cycle.

Competition comes from above, beside, and inside the stack. Above: global automotive cyber vendors such as VicOne and PlaxidityX sell ECU security, virtual patching, and compliance programs. Beside: India-local device firms such as SecureLayer7 can test firmware/BLE, but their public pitch is generic IoT rather than homologation-aware EV incident response. Inside: BMS/VIM vendors already sell the electronics, diagnostics, and OTA layer, so the most common substitute will be a quiet supplier patch rather than another startup [34][37][77][78][79][89].

Why incumbents do not win by default

• Global automotive cyber platforms. Strong on CSMS, IDPS, and ECU pentesting, but optimized for larger OEM programs rather than fast India-budget remediation and dossier work.
• India-local IoT pentesters. Can do hardware, firmware, radio, and OTA testing, but their public positioning is generic IoT rather than EV-specific homologation support.
• EV electronics and BMS vendors. Already own BMS, VIM, and flashing workflows, but OEMs may still want an independent fixer because the supplier stack is implicated in the flaw.
• Public test and homologation labs. Useful as validation and referral channels, yet they do not ship emergency patches or own the field incident.

The company starts as an incident-led BLE and firmware remediation studio for India's budget electric two-wheeler OEMs using white-label BMS stacks implicated in the July 2026 remote-shutdown episode. The first customer is a sub-50,000-unit OEM whose companion app was flagged or removed and whose founder or CTO needs dealer activations and rider trust restored fast. The wedge is not generic automotive cybersecurity; it is a fixed-scope sprint that inventories the board and protocol path, patches authentication and command control, and produces an evidence pack for MeitY, app-store, and lab review. Research suggests this wedge is reachable because the long tail beyond TVS, Bajaj, and Ather still represented 259,466 high-speed units in Jan-May 2026, while low-speed exposure is likely broader. The business only works as venture-backed if it moves quickly from one-off services into recurring release assurance and supplier licensing, because the researched initial market is only about $5.4M TAM, $2.6M SAM, and $1.3M three-year SOM. The planned sequence is to win 2-3 OEM incidents, reuse the protocol and flashing harness across the first common board families, and then sell a secure reference layer to the suppliers serving multiple OEMs. The moat is operational speed and evidence: a reusable CAN, UART, and RS485 harness library, reinstatement dossier templates, and field failure data that generic pentesters and implicated suppliers do not own. The biggest disconfirming risk is that Google, Apple, MeitY, or lab reviewers accept minimal supplier patching without independent evidence, leaving this as a low-margin services niche. Research also could not verify which named OEMs were actually removed from stores versus only exposed in reporting, so the first 90 days must prove actual removal status, acceptance criteria, and board overlap before scaling hiring.

Problem

• Budget Indian e2W OEMs share white-label BLE and BMS stacks with weak access controls, so one supplier flaw can trigger remote shutdowns, rider downtime, and store-removal risk across multiple brands.
• The likely buyers do not have in-house firmware security teams, and their fallback options — generic pentests or a quiet supplier patch — do not reliably produce independent evidence or repeatable hardening.

Solution

• Deliver a rapid remediation sprint that inventories the board, app, and protocol stack, patches pairing, authentication, and high-risk battery commands, and hands the OEM a regulator-ready evidence pack.
• Turn repeated incident lessons into a secure reference layer, release-test checklist, and recurring assurance offering that suppliers and OEMs can adopt before the next OTA or firmware release.

Why we win

• The company is optimized for India-budget EV incident response and app-reinstatement evidence, not generic enterprise automotive cyber programs or generic IoT pentests.
• Each engagement compounds a reusable asset base — board and protocol harnesses, flashing workflows, and dossier templates — that can raise speed, margins, and supplier-side leverage after the first few wins.
• As a neutral fixer, the company can be more credible than an implicated BMS supplier and more operationally focused than public labs or global platforms.

Milestones

flowchart LR
  Wedge[Flagged budget e2W OEMs on shared BMS apps] --> MVP[Rapid audit patch and evidence MVP]
  MVP --> Proof[Accepted evidence retained OEMs and reusable harnesses]
  Proof --> Expansion[Supplier license release assurance and 3W adjacency]

Founding team

Experiment roadmap

Risk assessment

What must be true

• At least 2 of the first 6 named or adjacent target OEMs hire a third-party remediator instead of relying only on the original supplier.
• A $20k-$40k sprint price is acceptable because app unavailability or activation delays create measurable dealer or fleet loss.
• The first 10 target OEMs collapse into 2-3 reusable board and protocol families rather than a fully bespoke reverse-engineering backlog.
• App-store, regulator, or lab reviewers value independent evidence enough to make the dossier a real purchase driver.
• At least 1 BMS or connectivity supplier converts OEM proof into a paid reference-stack license within 12 months.

Open diligence questions

• Which named OEMs were actually removed from Google Play or the App Store, and for how long were activations blocked?
• What board, app, and protocol families dominate the first 10 targets, and how much code or harness reuse do they allow?
• Do Google, Apple, MeitY, ARAI, or iCAT require third-party evidence, or would a supplier patch alone satisfy the buyer?
• What measurable commercial loss per day makes the proposed sprint pricing credible for budget OEMs?
• Which supplier has both enough white-label reach and enough urgency to pilot a neutral secure reference layer?

Model sanity

• Revenue engine. Base-case revenue starts with three OEM incident proofs, converts them into recurring assurance, and then uses those references to add one $300K-class supplier account by Y3.
• Must go right. Board overlap has to be real enough that a five-person team can support nine paying accounts without adding a services bench.
• Model breaks if. If independent evidence does not change buyer behavior and the supplier pilot slips, the downside case falls to about $0.9M Y3 revenue and cash can compress toward the low-$200Ks.
• Next-round proof. The next financing story is at least two retained OEMs plus a paid supplier pilot by Q2Y2, proving the wedge is moving from incident work into repeatable distribution.

Scenarios

Sensitivity

flowchart LR
  Leads[Incident-led OEM leads] --> Sprints[Paid remediation sprints]
  Sprints --> Retainers[Release-assurance retainers]
  Retainers --> Revenue[Revenue]
  Retainers --> SupplierLicense[Supplier reference-stack license]
  SupplierLicense --> Revenue
  Revenue --> GrossProfit[Gross profit]
  GrossProfit --> Cash[Cash and runway]

Flags: One supplier account plus high-end OEM retainers still drives a large share of Y3 revenue, so account concentration remains real. · The model assumes headcount stays flat from Q4Y2 through Q4Y3; if board fragmentation remains bespoke, both gross margin and delivery capacity will miss. · OEM ARPU reaches the high end of the BP's stated retainer range and assumes buyers continue paying for release assurance after the immediate crisis has passed.

• Regulatory urgency fades. If MeitY issues a blanket amnesty or the app stores quietly reinstate apps without per-OEM certification, the time-boxed budget and urgency driving this wedge could disappear. Mitigation: Sell recurring value beyond the one-time compliance event — ongoing monitoring, pre-release testing, and a dealer-facing "security certified" badge — so demand persists independent of any single regulatory action.
• Thin OEM budgets and low willingness to pay. Budget EV OEMs operate on thin margins and may treat security as a cost to minimize rather than invest in, especially once the immediate app-store crisis passes. Mitigation: Price against measurable downside (lost sales per day the app is pulled), offer success-based or milestone billing tied to reinstatement, and aggregate demand through OEM associations or dealer networks to lower per-customer acquisition cost.
• White-label vendors or large OEMs build this in-house. The original firmware vendors (Generic BAT BMS, Lossigy, Epoch Li-ion) could patch the flaw themselves at low cost, or a larger EV player could build in-house security tooling, cutting off the need for a third party. Mitigation: Move fast to become the neutral, regulator-trusted certifying party and embed the hardened reference firmware as licensed IP early, creating switching costs before vendors or large OEMs can replicate the compliance-dossier relationship with regulators.