From Floppy Disks to India's Frontline: Sanjay Katkar and the 30-Year Build Behind Quick Heal Technologies
How a Computer Science student from Pune turned a virus-cleaning utility into India's only listed cybersecurity company - and why the hardest chapter is still ahead.
In 1993, a significant number of computers arriving at a computer repair shop in Pune had no hardware problem at all. The culprit was a boot-sector virus, invisible and patient, corrupting files and stopping systems from starting. Sanjay Katkar, then a second-year computer science student, started writing small utilities on a floppy disk to fix them. He carried that floppy everywhere - to college labs, friends’ homes, the repair shop counter.
That floppy disk became Quick Heal.
I never thought of it as an antivirus product altogether. Customers would come in with systems that wouldn’t boot, files behaving strangely. I started writing small utilities to remove infections. That’s all it was.
Sanjay traced the full arc of a company built without venture capital for most of its life, without a distributor willing to back it, and without a product category India had yet learned to pay for.
Check out the video of the conversation here or read on for insights.
The Rejection That Built a Network
Quick Heal version 1.0 launched in 1995, priced at Rs. 450-500. For nearly three years, it sold almost nothing. Piracy was rampant. People paid for hardware, not software. But Sanjay kept improving the product, adding features global competitors had ignored: resumable updates for slow Indian connections, bootable tools for users running unlicensed operating systems.
By 1998-99, small offices and DTP shops in Pune were paying. The bigger test arrived when Quick Heal tried to scale nationally. Every major distributor - firms handling Oracle, Microsoft, and McAfee - turned them away. No one would sell an Indian software product.
Nobody was willing to sell a product built in India. They never trusted that something of that quality could come out of here. But that was a blessing. It forced us to build our own network.
What followed was a city-by-city expansion that most funded startups would not attempt. They opened a branch in Nasik first - not Mumbai - to test the model cheaply. It broke even within three to four months. Then a new city every six months, each branch capturing the market before moving to the next. By 2009, Quick Heal held 30% market share in paid antivirus across India, with roughly 50 internal salespeople managing a channel ecosystem that would eventually grow to 25,000 partners. Revenue was approaching Rs. 100 crore. The company had never raised external capital.
The IPO, the Margins, and the Enterprise Bet
In 2010, Sequoia Capital approached them. Sanjay did not go looking. The Rs. 60 crore infusion mattered less than what came with it: board structure, financial discipline, and the governance machinery that makes a public company possible.
In 2016, Quick Heal listed on the NSE and BSE - the first Indian cybersecurity software product company to go public. For Sanjay, the significance was practical rather than symbolic.
Being listed is a different feeling altogether. Every decision is under public lens. You’re accountable not just to customers but to thousands of shareholders. That changed how carefully we take decisions.
Listing gave Quick Heal something no marketing budget can manufacture: share value as acquisition currency, credibility in enterprise procurement, and trust signals that matter when bidding for national infrastructure contracts. In November 2025, the company secured a Rs. 64.25 crore contract with the NFSU Research and Innovation Council - a direct product of that institutional standing.
The financial story since listing has been one of deliberate reinvestment. At peak consumer antivirus, Quick Heal ran EBITDA margins close to 45%. Today they sit in the low single digits, as capital moves into next-generation enterprise security under the Seqrite brand. FY2024 revenue was Rs. 313 crore, with the current year projected around Rs. 350 crore and market capitalisation near Rs. 2,500 crore. The consumer business, once 95-99% of all revenue, has been compressed by OEMs bundling security into operating systems. Sanjay does not dispute this.
The enterprise bet is the counterweight - and the numbers justify the pivot. Enterprise renewal rates exceed 80%. Consumer renewal rates have fallen to 20-25%. The math is decisive.
Thirty Years of Escalating Threats
Sanjay’s account of how threats have evolved is less a technology briefing and more a study in how criminal industries mature. Early viruses were nuisance code, written to demonstrate skill. Email and broadband made malware global in minutes. Then monetisation arrived: credential markets, dark web data sales, ransomware-as-a-service.
The 2022 attack on AIIMS Delhi is the example he returns to. Months of silent reconnaissance preceded a single-night strike that locked every OPD, operating theatre, and administrative system simultaneously. Recovery took months, not days.
Fraud is becoming more personal, more convincing. Earlier, scams were generic. Today, messages are tailored, voices can be cloned, videos can be faked. AI is being used to scale deception.
Quick Heal’s response includes GoDeep.AI for predictive threat detection, SIA - an AI assistant that lets non-technical administrators configure security policy in plain English - and a recently launched Digital Risk Protection Service that monitors dark web activity, fake apps, and fraudulent social media handles outside an organisation’s own network. The DPDP Act, with its rules notified in November 2025 and a compliance deadline of May 2027, adds regulatory pressure that directly accelerates enterprise security adoption. Non-compliance penalties reach Rs. 250 crore.
Sanjay’s counsel to founders, shaped entirely by what almost ended Quick Heal in its first decade, is consistent with how he has always operated.
Whatever you’re good at, focus on that. Get the maximum market share. Scarcity makes you focus only on the pain points customers are actually paying for - not the fancy ones.
Cybercrime costs are projected to reach $10.8 trillion globally by 2026. The man who first debugged a virus in 1990 on a borrowed floppy is now defending hospitals, banks, and power grids. The product category has changed beyond recognition. The instinct that built it has not.
Listen now!
Other ways to listen:
Your Feedback matters
As always, I’d love to hear your thoughts! Whether it’s about this episode or ideas you’ve been playing around with, shoot me an email at ad@thepodium.in. Your feedback keeps these conversations going, and I’m always up for chatting about your startup ideas too.
Until next time,
Your Host,
Akshay Datt