5Tattva, a CERT-In empanelled cybersecurity solutions provider and PCI QSA company, participated in Cyber Warrior 40 — Delhi on August 26, 2026. The event, organized by CXO Hub, brought together 40 senior cybersecurity leaders for discussions on emerging threats and organizational resilience. At the gathering, 5Tattva presented its approach to 5Tattva integrated cybersecurity compliance.
The press release describes what the company does — VAPT, Red Teaming, Cloud Security, SOC Services, and cybersecurity consulting. Co-Founder Atul Luthra is quoted on the need for continuous, integrated assessments. The release lists the firm’s compliance certifications: PCI DSS, HIPAA, GDPR, ISO 27001, ISO 42001, and SOC 2.
What the press release does not do is explain why a decision-maker should choose 5Tattva over any of the 236 other CERT-In empanelled organizations in India. The release names no customer. It describes no proprietary technology. It mentions no revenue, funding, or employee count. This is a visibility announcement, not a product launch.
This article applies the TechRecast framework to find what the press release omits — and what the cybersecurity buyer actually needs to know.
What 5Tattva Announced
The announcement is straightforward. 5Tattva participated in an industry event and presented its existing service portfolio. The core message, articulated by Luthra, is that cybersecurity should be treated as a continuous process — not a periodic assessment — and that 5Tattva integrated cybersecurity compliance combining VAPT, configuration reviews, and compliance checks into a single view is more effective than treating them as isolated exercises.
This is a methodology pitch, not a product announcement. The press release describes no new tool, platform, or capability that did not exist before the event.
Layer 1 — Why Now: The CERT-In Empanelment Timeline
The timing of this press release connects to a specific milestone.
The October 2025 Empanelment
5Tattva received CERT-In empanelment on October 13, 2025 — less than one year before this announcement. The empanelment authorized the company to conduct cybersecurity audits for government departments, public sector undertakings, and critical infrastructure organizations across India. At the time, Luthra called the credential “a proud moment for all of us at 5Tattva” and said the recognition “validates our deep technical capabilities.”
Cyber Warrior 40 — Delhi is 5Tattva’s first major public industry appearance after receiving that empanelment. The press release is a visibility exercise aimed at telling CISOs that 5Tattva is now an authorized auditor — but does not explicitly state this as a recent achievement.
The Company’s Age
5Tattva is a young firm. Tracxn lists the company as founded in 2024 by Atul Luthra. LinkedIn shows Luthra’s start date as Co-Founder in April 2024. The legal entity is Five Tattva Cyberhub Security LLP, a partnership based in Gurugram. The company has been operating for approximately 18 months.
This context matters. A company that is 18 months old, with CERT-In empanelment achieved 10 months ago, participating in a CISO gathering is building visibility — not announcing a breakthrough.
The Cyber Warrior 40 Format
Cyber Warrior 40 is not a conference. The format is an invitation-only leadership forum organized by CXO Hub, a Gurugram-based community platform. The Delhi edition followed a Chennai launch and brought together 40 CISOs for an evening of peer learning and networking. The structure is discussion-driven, not presentation-driven — which makes 5Tattva’s presence as a presenting partner a brand-visibility play, not a product showcase.
Layer 2 — Competitive Positioning: A Fragmented Market
5Tattva operates in one of India’s most fragmented professional services markets.
The India Cybersecurity Market
India’s cybersecurity market is estimated at $5.56 billion to $11.34 billion in 2025, depending on the research firm. Mordor Intelligence projects the market to reach $15.06 billion by 2031 at an 18.07% CAGR. Imarc Group projects $44.04 billion by 2034 at a 15.46% CAGR. Alora Advisory estimates $8.8 billion in 2025, growing to $18.5 billion by 2030. The variance across estimates is significant, but all agree on double-digit growth driven by DPDP Act enforcement, CERT-In mandates, and BFSI compliance.
The CERT-In Empanelment List
As of August 2026, CERT-In’s published list carries 237 empanelled organizations. 5Tattva is one of them — and one of the newest. The list includes established players with years or decades of audit history.
SISA
Bengaluru-based SISA is a PCI QSA company and CERT-In empanelled auditor with a payments-focused specialization. Founded in 2006, SISA has built a global practice around payment ecosystem security. The company offers an “Agentic SOC,” forensic investigation capabilities, and a proprietary Cyber Index scoring framework. SISA’s depth in payments compliance dwarfs 5Tattva’s 18-month track record.
Kratikal
Noida-based Kratikal has been CERT-In empanelled for over five years. The company serves 650+ enterprises and SMEs and has developed AutoSecT, an AI-driven VAPT and vulnerability management platform. Kratikal’s compliance integration maps every vulnerability finding directly to PCI DSS, RBI, or ISO 27001 controls — the same 5Tattva integrated cybersecurity compliance concept, but with a proprietary platform behind the methodology.
Briskinfosec
Chennai-based Briskinfosec is India’s only CREST-approved company for both Vulnerability Assessment and Penetration Testing. This dual CREST accreditation — recognized in the UK, EU, Middle East, and APAC — gives Briskinfosec an international credibility marker that 5Tattva does not possess. Briskinfosec serves 640+ organizations across 30+ countries.
Big-4 and Tier-1 IT Services
KPMG, EY, Deloitte, and PwC India all hold CERT-In empanelment. TCS, Wipro, Infosys, and HCLTech offer full-spectrum cybersecurity services with global delivery capability. These firms dominate enterprise cybersecurity spending in India, collectively representing approximately 16% of services spend.
5Tattva’s Position
5Tattva is one of 237 CERT-In empanelled firms in a market with 5,015 active cybersecurity competitors, according to Tracxn. The company’s website lists 200+ satisfied customers — a meaningful number for an 18-month-old firm, but a fraction of Kratikal’s 650+ or Briskinfosec’s 640+.
5Tattva’s differentiation, as stated in the press release, is the 5Tattva integrated cybersecurity compliance concept. But Kratikal already maps vulnerability findings to compliance controls. Briskinfosec already combines VAPT with compliance under a CREST-certified framework. The integrated approach is not unique to 5Tattva — the entire Indian cybersecurity audit market is moving in this direction.
Layer 3 — Public-Data Sweep: Company Profile and Leadership
5Tattva’s public footprint is small but growing.
Company Structure
5Tattva is an unfunded company. Tracxn confirms no funding rounds. The legal entity is Five Tattva Cyberhub Security LLP, a partnership — not a private limited company. The firm is headquartered in Gurugram, Haryana, with workforce distributed across India, the United States, and Costa Rica.
LinkedIn reports 37 employees, growing 70.8% year-over-year — adding 17 people in the past year. The company has 3,203 LinkedIn followers. Its website is built on Wix, a consumer-grade website builder.
Leadership
Atul Luthra, Co-Founder and Principal Consultant, has over 25 years of experience in auditing and technology. He holds certifications as PCI DSS QSA, ISO 27001 Lead Auditor, CISSP, CISA, SOC 2, and GDPR/HIPAA Assessor. Before founding 5Tattva, he held partner-level positions at GTIS (Cyber Security) and served as Head of IT at VR Limited. Luthra is also CEO of Zeroday Ops, which 5Tattva acquired.
Manpreet Singh, Co-Founder and Principal Consultant, brings 15+ years in IT security with CISA, CISM, and ISO 27001 certifications. His expertise lies in orchestrating audits within complex IT infrastructure environments.
Ramit Luthra, on the leadership team, brings experience from McKinsey, BlackRock, Citigroup, and Edward Jones, with executive education from Columbia University. His background in digital strategy for Fortune 500 companies adds enterprise depth.
Kunal Mahar serves as Head Security Operations, with 12+ years in cybersecurity and certifications including CRTO (Certified Red Team Operator) and CEH.
The Zeroday Ops Acquisition
Atul Luthra’s LinkedIn profile reveals that 5Tattva acquired Zeroday Ops, a VAPT solutions company. This acquisition is not mentioned in the press release. The acquisition explains how 5Tattva built its offensive security capabilities — through purchase rather than organic development.
CERT-In Empanelment Details
CERT-In empanelment is granted for a defined period, typically three years, and requires renewal. 5Tattva’s empanelment was announced in October 2025. The credential authorizes the company to perform compliance audits, configuration reviews, and penetration testing for sectors including banking, energy, telecom, defense, and other regulated industries.
The empanelment process involves a documented technical assessment by MeitY. The credential is not trivial — but with 237 empanelled firms, the status is a baseline requirement for government and regulated-sector audit work, not a differentiator.
Layer 4 — The Unasked Question: What Is the Differentiator?
The most important question is what 5Tattva offers that 236 other CERT-In empanelled firms do not.
The “Integrated Assessments” Concept
Luthra’s quote describes bringing vulnerability assessment, penetration testing, configuration reviews, and compliance checks “into a single, unified view rather than treating them as isolated exercises.” This is a sound methodology. But the approach is not proprietary.
Every serious cybersecurity audit firm in India has moved toward integrated assessments. The DPDP Act, CERT-In’s six-hour incident reporting mandate, RBI’s cybersecurity framework, and SEBI’s CSCRF all push organizations toward continuous, integrated compliance. The market is moving in this direction regardless of 5Tattva’s advocacy.
The Missing Details
The press release names no customer. The release includes no case study. The announcement describes no proprietary tool, platform, or methodology that competitors lack. The release does not mention whether 5Tattva’s SOC uses AI or SOAR — despite Luthra’s prior interviews describing AI-driven SOC capabilities. The Zeroday Ops acquisition and how the purchase enhanced 5Tattva’s capabilities are absent.
The Pricing Silence
No pricing information appears in the press release or on 5Tattva’s website. The website offers a “fixed scope, fixed price, no surprises” model for compliance certifications — a positioning that distinguishes 5Tattva from larger firms with variable pricing. But the press release does not mention this model.
The Size Question
With 37 employees, 5Tattva is a boutique firm. This is not inherently a disadvantage — boutique firms often deliver more personalized service and senior-level attention than large integrators. But the press release does not frame 5Tattva’s size as an advantage. The release presents the company as a comprehensive cybersecurity provider without acknowledging the scale gap between itself and the Big-4, Tier-1 IT services firms, or even mid-sized competitors like Kratikal.
Layer 5 — Honest Translation: What the Claims Mean
“CERT-In Empanelled Cybersecurity Solutions Provider”
This is a factual credential. 5Tattva is on the CERT-In list. But 236 other firms hold the same credential. The status is a necessary qualification for government and regulated-sector audit work, not a competitive differentiator.
“PCI QSA Company”
This is also factual. Atul Luthra is a PCI Qualified Security Assessor, certified by the PCI Security Standards Council. 5Tattva can perform PCI DSS audits worldwide. But SISA, VISTA InfoSec, and multiple Big-4 firms hold the same QSA credential with longer track records.
“Integrated Assessments”
This is a methodology pitch, not a product or platform. The concept of combining VAPT, configuration reviews, and compliance checks into a unified view is sound — but the approach is not proprietary. Kratikal maps findings to compliance controls. Briskinfosec combines VAPT with GRC under CREST certification. 5Tattva integrated cybersecurity compliance is an industry trend, not a 5Tattva innovation.
“Treat Cybersecurity as an Ongoing Business Function”
This is a widely held view across the cybersecurity industry. Every managed security services provider advocates continuous monitoring over periodic assessments. The statement is correct but not differentiated.
“24×7 Security Operations Centre”
Standard offering. Every serious cybersecurity firm in India — from TCS to Kratikal to Qualysec — operates a 24×7 SOC. 5Tattva’s website describes AI-driven SOC capabilities, but the press release does not elaborate on what makes its SOC different.
Layer 6 — Decision-Maker Framing: Who Should Care
For CISOs and Security Leaders
5Tattva is a legitimate CERT-In empanelled, PCI QSA-credentialed cybersecurity firm with experienced leadership. If you are a mid-market organization in India seeking VAPT, compliance audits, or SOC services, 5Tattva is qualified to deliver. But so are 236 other firms.
Ask what proprietary tools or methodologies 5Tattva uses that competitors do not. Request named customer references in your industry. Ask about the Zeroday Ops acquisition and how the purchase enhanced their offensive security capabilities. Ask about their fixed-price compliance model and how the offering compares to larger firms on cost and scope.
For the Cybersecurity Market
The Indian cybersecurity market is growing at 15-18% CAGR, driven by regulatory mandates. But the audit and VAPT segment is extremely fragmented. 237 CERT-In empanelled firms compete for the same government and regulated-sector contracts. The market will consolidate around firms that build proprietary platforms, earn international accreditations like CREST, or develop deep vertical specializations.
5Tattva has none of these differentiators today. The firm has CERT-In empanelment, PCI QSA credentials, experienced founders, and a growing team. That is enough to compete — but not enough to stand out.
For 5Tattva
The company’s growth trajectory — 37 employees growing 70% year-over-year, 200+ customers, CERT-In empanelment in its first year — is credible for an 18-month-old firm. But the press release undersells the company. The Zeroday Ops acquisition, the AI-driven SOC capabilities described in prior interviews, the fixed-price compliance model, and Ramit Luthra’s Fortune 500 experience are all differentiators that the press release ignores.
A better press release would have named a customer, quantified a result, described a proprietary capability, or announced a new service. Instead, this release describes participation in an event — which is the weakest form of corporate announcement.
What Is Genuinely New vs. What Is Repackaged
Genuinely New
Nothing. This press release announces no new product, platform, capability, or partnership. The release describes a company presenting its existing services at an industry event.
Improving
5Tattva’s visibility is increasing. The company has moved from founding to CERT-In empanelment to industry-event participation in 18 months. The leadership team’s credentials — PCI QSA, CISSP, CISA, CRTO — are genuine. The 70% headcount growth suggests demand for the firm’s services.
Repackaged
The 5Tattva integrated cybersecurity compliance concept is a repackaging of existing cybersecurity audit practices that the entire industry is adopting. VAPT, Red Teaming, Cloud Security, and SOC Services are standard offerings. The compliance certifications — PCI DSS, HIPAA, GDPR, ISO 27001, ISO 42001, SOC 2 — are credentials, not capabilities.
Unclear
What proprietary technology or methodology differentiates 5Tattva from 236 other CERT-In empanelled firms. How many customers use 5Tattva’s 24×7 SOC. What the Zeroday Ops acquisition added to 5Tattva’s capabilities. What 5Tattva’s revenue or growth rate is. Whether the “fixed scope, fixed price” model is a genuine market differentiator or simply a website positioning statement.
The Question the Press Release Doesn’t Answer
Can a boutique cybersecurity firm with 37 employees, no funding, and no proprietary platform compete meaningfully in a market with 237 CERT-In empanelled competitors — including Big-4 firms, Tier-1 IT services giants, and CREST-accredited specialists?
The Market Reality
The Indian cybersecurity audit market is not a winner-take-all market. This is a services market where relationships, sector expertise, and pricing matter as much as technical capability. A boutique firm with experienced leaders and the right credentials can build a profitable niche — particularly among mid-market organizations that are too small for Big-4 engagement but too large for freelancer-level security testing.
5Tattva’s 200+ customers in 18 months suggests the company has found that niche. The 70% headcount growth suggests demand is real. The fixed-price compliance model addresses a genuine pain point in the Indian audit market — where scope creep and surprise costs are common complaints.
The Differentiation Gap
But the press release does not tell this story. The release presents 5Tattva as a comprehensive cybersecurity provider without acknowledging the competitive context. A CISO reading this release learns that 5Tattva exists, is CERT-In empanelled, and offers standard cybersecurity services. The CISO does not learn why 5Tattva is different, better, or worth evaluating.
The answer to the differentiator question may be 5Tattva’s fixed-price model, its Zeroday Ops-acquired offensive security capabilities, or its leadership team’s combination of compliance depth and enterprise strategy experience. But the press release does not make that case.
The Verdict
5Tattva is a credible, growing, well-credentialed cybersecurity firm. The press release is not. The release is a visibility announcement that undersells the company by omitting its most interesting attributes — the Zeroday Ops acquisition, the AI-driven SOC, the fixed-price model, and the leadership team’s enterprise pedigree.
For a company competing against 237 empanelled firms, the inability to articulate a differentiated value proposition in a press release is a missed opportunity. The cybersecurity buyers at Cyber Warrior 40 heard 5Tattva’s presentation. This press release does not give them a reason to follow up.
Editor’s Note
This article is based on the press release issued by 5Tattva (Five Tattva Cyberhub Security LLP) on September 2, 2026, via Alliance Public Relations Pvt. Ltd., and additional publicly available information including the 5Tattva website (5tattva.com), LinkedIn company page, Tracxn company profile, CXO Hub LinkedIn posts about Cyber Warrior 40 Delhi (August 26, 2026), the October 13, 2025 CERT-In empanelment announcement covered by
Enterprise Times, India Technology News, and APAC News Network, DQ Channels interviews with Atul Luthra (September 2025, January 2025), CXO Media interview (March 2025), BIS Infotech interview (December 2024), SmartStateIndia feature (July 2025), CX Quest feature (June 2025), Mordor Intelligence India Cybersecurity Market Report 2026, Imarc Group India Cybersecurity Market Report, Alora Advisory India Cybersecurity Market Outlook 2030,
Grand View Research India Cyber Security Market Outlook, Security Boulevard Top 10 CERT-In Empanelled Auditors 2026, Qualysec Top Cybersecurity Companies in India 2026, api4soc CERT-In Empanelled Auditor List 2026, Macksofy CERT-In Empanelment Process 2026, PeerSpot vendor comparisons, Kratikal company website, SISA company website, Briskinfosec company website, and ISECURION company website. 5Tattva is a partnership (LLP), not a publicly traded company.
No financial data — revenue, funding, or profitability — is publicly available. The 200+ customer count is company-claimed from the 5Tattva website. The 37-employee figure is from LinkedIn and may not reflect current headcount. CERT-In empanelment status should be verified against the live list at cert-in.org.in before contracting.
Contact: techrecasteditor@gmail.com