Only 3 of 10 CSPM vendors document an India region; banks should ask the other 7
Ten CSPM vendors in TechBag's cloud security guide, checked for an India region and a printed price against RBI's July 2026 cyber Directions, as of September 2026.
The 2024 version of this piece listed nine things a CSPM tool does for a bank, from asset inventory to open-port alerts, and stopped there. The question an Indian bank’s IT risk team actually brings is different: which product can we put in front of the auditor, and where will it keep what it finds?
01Where the findings live
A CSPM tool reads the configuration of every cloud account through the provider’s APIs; several also take disk snapshots of workloads to scan for vulnerabilities and, in data-security modules, sample the data itself. The workloads already sit in a region you chose. The question is where the findings and snapshots are processed and stored.1
Seven of ten CSPM vendors do not yet document an India region for their findings
CSPM vendors in TechBag's cloud & workload security guide, by documented India region, September 2026
- No India region documented: Wiz, Check Point, Tenable, Trend Micro, Fortinet, Bitdefender6 vendors 60%
- Announced, not yet documented live: CrowdStrike, January 20261 vendors 10%
- India region documented: Qualys, SentinelOne (Mumbai), Sophos (Mumbai)3 vendors 30%
Table view
| Value (vendors) | Share | |
|---|---|---|
| No India region documented: Wiz, Check Point, Tenable, Trend Micro, Fortinet, Bitdefender | 6 | 60% |
| Announced, not yet documented live: CrowdStrike, January 2026 | 1 | 10% |
| India region documented: Qualys, SentinelOne (Mumbai), Sophos (Mumbai) | 3 | 30% |
Source: TechBag cloud & workload security guide, vendor documentation verified 22 August 2026 · as of 30 September 2026 · Kaspersky, in the guide for workload protection, sells no CSPM and is excluded
That matters for one rule above all. RBI’s direction on the storage of payment system data, issued on 6 April 2018, requires the entire data relating to payment systems to be stored only in India, and it reaches third-party vendors.4 Configuration findings are not payment data. A snapshot of a payments server may be. Whether a given scan crosses that line is for the bank’s compliance team to decide from the vendor’s architecture document, not from its datasheet.
02What CSPM proves to an RBI inspector, and what it does not
RBI replaced 628 supervisory circulars with 64 consolidated Directions on 31 July 2026; seven cover cybersecurity, one per licence class, and all took effect on issue with no transition period.3 The urban co-operative bank version lists 24 Level I sections, A to X.2
03Cost, and the India rules that bite
Prices are scarce. Fortinet publishes a FortiCNAPP starter pack from about US$25,000 a year; Wiz Essential is reported by resellers at about US$24,000 a year for 100 workloads; Sophos sells pay-as-you-go on AWS Marketplace; Trend Micro meters in Vision One credits; the rest quote.1 TechBag invoices in INR with 18% GST. Besides the RBI Directions, a bank runs CERT-In’s six-hour incident reporting and 180-day log retention within Indian jurisdiction, in force since 28 April 2022.5 A bank’s broking or asset-management arm also answers to SEBI’s Cybersecurity and Cyber Resilience Framework, issued on 20 August 2024.6
Sources
- TechBag, Cloud & workload security (CNAPP) guide: 16 products, India region and pricing per vendor — vendor documentation verified 22 August 2026
- RBI, Urban Co-operative Banks: Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026 (Chapter III, Level I, sections A to X) — 31 July 2026
- RBI, repeal circular DoS.CO.PPG.66/11.01.005/2026-27 (628 circulars repealed, 64 Directions issued) and Master Directions list — 31 July 2026
- RBI, Storage of Payment System Data, RBI/2017-18/153 — 6 April 2018
- CERT-In, Directions under section 70B(6) of the IT Act, 2000 (6-hour reporting; 180 days of logs within Indian jurisdiction) — 28 April 2022
- SEBI, Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities — 20 August 2024
Related on TechBag: the cloud & workload security guide shortlists all 16 products by runtime, agent and region; BFSI obligations maps each RBI section to the tools and a cost band.
Disclosure. TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.
Keep reading
