EDR/XDR Solution
Patch Management as a Service
OT Security Services
Zero Trust VPN Access
PIM/PAM Solution
Managed SOC Services
Managed Data Loss Prevention
MDR Services
VAPT
Social Engineering Assessment
Red Team Assessment
ESMA – Maturity Assessment
Imperum
Discover. Design.
Defend. Evolve. - D³E
AiCyberWatch's Proprietary Cybersecurity Methodology.
Most security providers deploy tools and hope for the best. We follow a methodology registered, repeatable, and refined over three decades of operational defence. D³E™ is how India's most ambitious organisations move from vulnerable to fearless.
A methodology, not a service catalogue.
Most security providers deploy tools and hope for the best. We follow a methodology.
D³E is the structured, repeatable, and continuously improving process behind every AiCyberWatch engagement. Built from three decades of operational experience defending India's most ambitious organisations, it transforms cybersecurity from a series of disconnected tools into a coherent strategic capability — one that adapts as your business, your threats, and your regulatory landscape evolve.
Four phases. One continuous cycle. Every phase produces a tangible artefact you can hold in your hands and present to your board. Every phase ladders into the next. And every year, we run the cycle again — measuring how far you have come, identifying where the next round of investment matters most, and refining your defence to match the business you have become.
The Four Phases
Inside D³EE
The four phases are sequential the first time we run them, and continuous from then on. Each phase produces an asset that becomes the input to the next. The cycle never closes, it tightens.
Discover
Before we defend anything, we understand everything.
Every engagement begins with deep discovery. We assess your security maturity across 8 domains and 94 controls using our proprietary ESMA™ methodology, map your industry-specific threat landscape, catalogue your full infrastructure, and align with your leadership on what matters most.
The output is not a generic checklist - it is a Security Posture Scorecard built from your reality, your regulatory obligations, and your business priorities. ESMA scoring runs on a 5-level maturity scale and produces a colour-coded heatmap, eight domain-level radar charts, a written report with prioritised recommendations, and a 12-month improvement roadmap.
See the full ESMA™ Assessment →Design
Defence without architecture is chaos. We design before we deploy.
Armed with the intelligence from Discover, we architect your Defence Blueprint a custom security design tailored to your environment, your risks, and your regulatory obligations. Detection logic tuned to your threat vectors. Response playbooks built for your scenarios. Integration planned for your technology stack, not ours.
The Blueprint is co-designed with your team across structured architecture sessions, mapped against industry frameworks (NIST CSF, IEC 62443, the Purdue Reference Model), and validated against your specific compliance perimeter. What you receive is an architecture that any auditor, any board, any successor CISO can understand and defend.
Defend
Your shield goes up. 24/7. 25+ analysts. Under 15 minutes.
Defend is where the Fusion Centre comes alive. Our 25+ dedicated analysts monitor your environment around the clock, powered by Agentic-AI autonomous SecOps engine and the custom detection logic designed specifically for you in the previous phase. Millions of events triaged daily. Incidents responded to in under fifteen minutes, mean.
Live in five weeks from contract. Fully operational from day one. The difference is not gradual you feel it the morning your first incident is contained before your team has even logged in.
Imperum operates on a Detect · Defend · Disrupt posture — autonomous, simultaneous, real-time. (Distinct from D³E, which describes the methodology you experience.)
Evolve
Security that grows as you grow. Threats change. So do we.
D³E does not end at Defend. Every quarter, we review your posture, optimise detection logic, refresh playbooks, and align with your changing business. Every year, we re-run ESMA™ in full producing a measurable year-over-year delta that shows your leadership exactly how your security maturity has improved, where new gaps have emerged from your growth, and where the next twelve months of investment should land.
This is the part of cybersecurity most providers never get to. The longer the partnership runs, the stronger your defence becomes — not because we are working harder, but because the methodology compounds. That is not a sales pitch. That is how the mathematics of D³E works.
Re-run ESMA™ annually →Why It Matters
Most security engagements are static. The world is not.
You sign a contract. Tools get deployed. The vendor checks the box and hopes nothing changes. But everything changes your infrastructure expands, your threat landscape mutates, your regulatory perimeter tightens, your business pivots. Six months in, the defence you bought no longer matches the organisation you have become. Twelve months in, it is actively dangerous: a false sense of security calibrated to a reality that no longer exists.
D³E is built for a world that never stands still. The methodology assumes change is the constant. Discover gives you ground truth. Design produces architecture that anticipates pivots. Defend operates a SOC built to absorb them. Evolve is the disciplined cadence that re-anchors all three to wherever your organisation has moved to. The result is not a security posture you bought — it is a security capability you operate.
Regulatory Fit
D³E maps cleanly to the frameworks your auditors care about.
ESMA's eight domains and ninety-four controls have been engineered to crosswalk against the regulatory regimes that matter most to enterprises operating in India and beyond. We do not retrofit findings to compliance after the fact — the assessment is structured from inception to produce evidence that auditors and regulators recognise.
Domain D4 (Data Protection) maps directly to DPDP obligations: classification, consent, retention, breach notification.
Eight domains map to CSCRF's Identify-Protect-Detect-Respond-Recover lifecycle. ESMA produces audit-ready evidence.
Domain D7 (OT/IoT) is structured around IEC 62443 zones-and-conduits and the Purdue Reference Model.
ESMA's maturity scoring is calibrated to NIST CSF's tier model — direct translation for global stakeholders.
Domain D8 (Governance & Compliance) maps Annex A controls to ESMA's governance scoring.
L0–L5 zones mapped explicitly into Domain D7 scoring — particularly relevant for manufacturing and energy.
Why This Works
What separates D³E from a typical security engagement
| A typical engagement | D³E |
|---|---|
| Tools deployed first, posture understood later (or never). | Posture understood first via ESMA™ — every subsequent decision flows from ground truth. |
| Generic detection rules, vendor-shipped defaults. | Detection logic custom-tuned to your threat profile in the Design phase. |
| Static. Same defence in year three as year one. | Quarterly tuning. Annual re-assessment. The defence ages forward, not backward. |
| Compliance treated as a separate workstream. | Compliance evidence produced as a by-product — DPDP, SEBI CSCRF, IEC 62443 mapped from day one. |
| CISO measured by absence of incidents (a brittle KPI). | CISO measured by maturity progression — a defensible, board-ready metric. |
| Vendor lock-in. Every tool change is a re-platforming event. | Methodology-led. Tools serve the methodology, not the other way around. |
Proof
Three engagements. Three industries. One methodology.
Anonymised illustrations actual maturity deltas measured via successive ESMA™ assessments across 9-to-12-month engagements.
~3,500 employees · 250+ branches
Trigger: SEBI CSCRF deadline + post-incident review.
Largest moves: Identity & Access 1.8 → 4.1 (MFA + PAM), Cloud Security 1.5 → 3.4 (CSPM), Governance 2.5 → 4.0 (CSCRF readiness). MTTD dropped from 14 hours to 22 minutes.
5 hospitals · 1,200 beds
Trigger: DPDP exposure + sector-wide ransomware pressure.
Largest moves: Data Protection 1.6 → 3.5 (DPDP-aligned classification + DLP), OT/IoT 1.2 → 2.9 (medical-device segmentation), Endpoint 2.0 → 3.6 (EDR rollout). Two ransomware attempts blocked in Q2.
8 plants · ~6,500 employees
Trigger: OEM customer cybersecurity questionnaire + IEC 62443 push.
Largest moves: OT/IoT 1.4 → 3.2 (Purdue model), Network 1.9 → 3.6 (IT/OT segmentation), AppSec 1.7 → 3.1 (secure SDLC). IEC 62443 alignment achieved for L3.5 zones; two OEM audits cleared.