Watching Both Surfaces: A Dual-Surface Detection Model for MSMEs without a SOC

Organisations with shared IT responsibility and no dedicated 24x7 security operations centre now face two detection problems on the same desk. The first is familiar: endpoints, mail, identity and cloud. The second is newer: unofficial AI tools, model and data provenance, and agents that can write records, send mail or initiate payments. Major frameworks describe both problems, but none specifies a first sequence that a thinly staffed Indian organisation can run without adding a second console nobody opens.

Developed by the Shridhar InfoSec Solutions R&D Wing as a targeted narrative synthesis of CERT-In directions, NIST, NCSC and OWASP guidance and recent Indian small-business surveys, this whitepaper proposes a Dual-Surface Detection Model built on four jobs (Watch, See AI use, Limit damage and Stay honest) and ten controls. It supplements, and does not replace, CERT-In's fifteen elemental cyber defence controls for MSMEs and the April 2022 directions on logging, time synchronisation and incident reporting.

The paper maps each control to an owner, an acceptance test and retained evidence, and sets out automation and approval limits, a 90-day plan, a proposed validation approach and an illustrative scenario. It is evidence-informed rather than empirically validated, and is general cybersecurity guidance, not legal or compliance advice.