Cyber range in India: a plain-words buyer's guide

SEBI CSCRF

Scenario-based drill exercises (RC.RP.S3): half-yearly for MIIs and qualified REs, yearly for other REs. The rule in full

RBI

Periodic drills (Master Direction RBI/2023-24/107, 27e), and disaster recovery drills at least half-yearly (29a). The rule in full

CERT-In

Incidents reported within six hours (directions of 28 April 2022, clause (ii)). The rule in full

IRDAI

Incident reporting within six hours (Policy 2.10, clause 3.5), and a yearly disaster recovery drill (2.13). The rule in full

CERT-In also runs drills itself: by its own count (PIB, 23 January 2026), 122 drills with about 1,570 organisations. Every clause is on the compliance page.

Individual skills practice

One person works through guided exercises at their own pace. Good for building one person's hands-on skills.

Facilities for executive crisis exercises

A physical room where leaders work through a crisis scenario together. Good for practising decisions and communication at the top.

Sector and OT ranges

Built around one industry's own equipment, such as the control systems of a plant or a grid (operational technology, OT). Good for the engineers who run that equipment. Setu Range is not this kind: it is for enterprise IT.

Whole-team drills, measured with a scorecard

Your whole SOC team works one real, automated attack on one clock, and a scorecard shows what was caught, how fast, and how each number was measured. Good for proving how the team performs together. This is Setu Range.

Setu Range is the fourth kind. Its Labs, on the same engine, are built for the first: individual practice.

Built in India

Setu Range is built by Cyber Whisper in New Delhi.

Supported in Indian hours

The team that runs your drill and answers your questions works in Indian hours.

Shaped to Indian regulators

Cyber Whisper maps the drill's evidence to the clauses SEBI CSCRF, RBI, CERT-In and IRDAI ask about.

Hosted where you decide

Hosted by us, or installed on your own servers. You choose, so your data stays where you decide. We make no other promise about where data is kept.

Is it sealed from the world?

Nothing inside the range should reach anything real, and it should never connect to your production systems. Setu Range is sealed from the world: nothing inside it can reach anything real.

Is there a real SIEM?

Your analysts should work real alerts from real sensors, not a scripted screen. Setu Range gives your analyst a real SIEM fed by real sensors.

Does it measure two clocks?

How fast the tools detected the attack, and separately how fast your team raised it. Setu Range measures both.

Is there evidence behind each number?

Every result should say how it was measured. On a Setu Range scorecard, every number does.

Where does it run?

Ask whether it is hosted, on your own servers, or both. Setu Range is hosted by us, or installed on your own servers.

Which Indian regulator clauses does the scorecard map to?

Ask for the clause numbers, not only the regulator's name. Cyber Whisper maps a Setu Range drill's evidence to the clauses SEBI CSCRF, RBI, CERT-In and IRDAI ask about: see them on the compliance page.

Who runs the drill with us, and in which time zone?

A drill goes better with someone beside your team. The Cyber Whisper team designs, runs and reports the drill with your team, in Indian hours.

Zero Hour team drills

Your whole SOC team against a real, automated attack on a realistic enterprise environment, today a realistic bank network: the analyst in a real SIEM, with observers and a controller.

The scorecard

What was caught, how fast, and how each number was measured: two clocks, the systems your team reported as hit, and each step of the attack mapped to MITRE ATT&CK.

Labs

Guided labs for one person at a time, on the same engine as the team drills: for example, a two-zone firewall lab.

Managed drills

The Cyber Whisper team designs, runs and reports the drill with your team.

Compliance gap assessment

Where you stand against SEBI CSCRF, RBI, CERT-In and IRDAI, with a fix plan. Delivered by the Cyber Whisper team.

Hosted by us, or on your own servers

Hosted by us, or installed on your own servers. You choose. Either way the range is sealed from the world and never connected to your production systems.

See how a drill runs, or the drills your regulator asks for.

Is there a cyber range made in India?

Yes. Setu Range is built in India by Cyber Whisper in New Delhi. It is hosted by us, or installed on your own servers.

What does a cyber range cost in India?

It depends on what you need. Setu Range is priced by drill, by team or by year, and we quote after a 30-minute briefing.

Can a cyber range run on our own servers?

Setu Range can. It is hosted by us, or installed on your own servers. You choose. Either way it is sealed from the world and never connected to your production systems.

Does a cyber range make us SEBI or RBI compliant?

No. Compliance is between you and your regulator. A cyber range gives you the exercise and the evidence: on Setu Range, a scorecard that shows what was caught, how fast, and how each number was measured.

How long does a drill take?

The automated attack itself is short: in the example exercise on our Platform page it runs from the first move to the scorecard in under five minutes, at a pace the room can follow. The time around it, to brief your team before and go through the scorecard after, is planned with you.