General information and education, not investment advice. The author is not a SEBI-registered adviser or research analyst. No recommendation, no promised returns. Markets carry risk including loss of capital. Figures may not be current. Always consult a SEBI-registered adviser.
1 — At a Glance
TAC Infosec sells cybersecurity software to organisations, and its shares trade on the NSE’s SME platform. The market values the company at about ₹1,029 crore. Sales in the three months to June 2026 were ₹19.78 crore. The same quarter a year earlier brought ₹9.76 crore, so growth was 103%. Annual revenue runs at roughly ₹57 crore. Operating margin, which is profit from the core business as a share of sales, was 48.18%. Net profit for the quarter was ₹7.79 crore.
Then the paperwork gets interesting. On 24 July 2026 the board gave in-principle approval to buy all of Safehouse Technologies Limited, Israel. The price is not to exceed ₹1 crore. The same morning the board approved a new subsidiary, TAC Safehouse Limited, with proposed investment of up to ₹4 crore. That is four times the price of the company being acquired into it. The board also allotted 1,040 shares under the staff share scheme, raising ₹5,200.
The NSE wrote in on 22 July with two questions. The exchange asked why the June-quarter results carried no authorised signatory, and where the segment details were. The company replied that the chairperson attended by video and delegated signing authority. It added that TAC operates in a single segment, so segment reporting does not apply.
Debtor days, the average wait to be paid, were 356 in the year to March 2024. They fell to 119 the next year, then rose to 145 in the latest one. Borrowings stand at ₹0.93 crore and cash at ₹33.23 crore. The company describes 10,000 customers across 100 countries. A subsidiary has filed an F-1, the form a foreign company files before listing in the United States.
2 — Introduction
TAC Infosec Ltd was incorporated in 2016. It listed on the NSE Emerge platform, the exchange’s board for small companies, on 5 April 2024. The offer raised ₹29.99 crore through 28.29 lakh shares. Of that, ₹18.65 crore was allocated to human resources and product development. Another ₹7.44 crore went to general corporate purposes and ₹3.90 crore to issue expenses. The June 2026 quarter filing reports ₹12.77 crore of the first bucket used, with no deviation reported.
The last twenty-four months have been busy in a way that small companies rarely are. In March 2024 the company acquired TAC Security INC in the United States. In September 2024 it completed the purchase of CyberSandia, an American cybersecurity firm. CyberSandia holds an exclusive contract to provide IT services in New Mexico. The same month TAC set up TAC Cyber Security Consultancy LLC in the UAE. In October 2024 it announced a partnership with Google as an authorised lab for mobile app security assessment, under the App Defence Alliance.
Then the corporate actions started stacking. In October 2025 came a bonus issue, one free share for every share already held. The allotment was about 1.05 crore shares. In December 2025 the subsidiary CyberScope Web3 Security Inc. publicly filed a Form F-1 with the US SEC, the American markets regulator. It had filed confidentially in August, and reserved the Nasdaq ticker ‘CYSC’. In March 2026 came a ₹1 crore ESOF licence order from a confidential Government of India data centre. Revenue on it is recognised from March 2026 to March 2027. The company states the margin on that order at 40%.
March 2026 also produced two departures. On 11 March the company secretary and compliance officer resigned with immediate effect. On 12 March the board approved immediate termination of SCS & Co LLP, citing misconduct or malpractice. In May 2026 Sanjiv Swarup resigned as independent director, effective 7 May. Hector Hugo Balderas was appointed for a three-year term.
In February 2026 an order of the National Faceless Appeal Centre, an income-tax appeal body, deleted a disallowance of about ₹5.03 crore under Section 80-IAC. That extinguished a demand of about ₹0.77 crore.
US
Now live
US Stocks terminal is live
13,000+ US tickers · EDGAR fundamentals · screener and filings feed — the same terminal, for American markets.
Explore →
3 — Business Model: WTF Do They Even Do?
TAC Infosec sells risk-based vulnerability management, cybersecurity quantification and penetration testing. Vulnerability management means scanning a customer’s systems for the weaknesses an attacker could use. The work is delivered like software over the internet, to organisations of any size, in India and abroad.
The flagship is ESOF, short for Enterprise Security in One Framework, launched in 2018. It is less a product than a shelf. On it sit ESOF Appsec, ESOF VMP and ESOF CRQ, and beside them ESOF VACA and ESOF PCI ASV. Between them they cover vulnerability management for web and application data, compliance assessment and cyber risk quantification. The shelf adds asset tiering, business unit regrouping and a cyber score. That is five acronyms and a scoreboard under one brand name.
The penetration testing side is ethical hacking with paperwork: find the holes, write them up, align the findings to GDPR and ISO 27001. GDPR is Europe’s data protection law, and ISO 27001 an information security standard. The company is CREST-certified, an accreditation held by security testers. In this trade that works roughly as a food licence does in a restaurant. Nobody praises a kitchen for holding one, and everybody notices when it does not.
The client list is bank-heavy and regulator-adjacent: HDFC, Bandhan Bank, BSE and the National Payments Corporation of India. DSP
