Services › VAPT

Vulnerability Assessment and Penetration Testing

Manual, evidence-led testing of your applications, infrastructure and APIs. Findings you can act on, not a scanner export with a logo on it.

India:All customer data is stored and processed in India. Our infrastructure runs in Indian data centre regions, and no customer data is replicated outside the country.

The Situation

Most organisations buy a penetration test because someone asked for the report, not because they want to know the answer. That shapes everything: the scope gets narrowed until it is cheap, the test runs against a staging environment that does not match production, and the report arrives with forty findings sorted by a scanner's severity rating rather than by what an attacker would actually do.

The useful version is different in three ways. The scope includes the things you are afraid of rather than the things that are easy to test. Findings are rated by what they let an attacker reach in your environment, not by CVSS in the abstract. And the report distinguishes between what was tested and found safe, what was tested and found broken, and what was never tested at all, because the third category is where the next breach usually comes from.

A clean report that does not say what it did not cover is not reassurance. It is an unanswered question.

Who This Is For

Anyone with an annual VAPT obligation under RBI, SEBI, IRDAI or CERT-In direction, and teams who want real assurance before a launch.

What You Get

  • Scoped test plan with rules of engagement and authorisation record
  • Web, mobile and API application testing aligned to OWASP methodology
  • External and internal network and infrastructure testing
  • Configuration review of firewalls, servers and cloud accounts
  • Findings rated by exploitability and business impact, with evidence
  • Remediation guidance written for the engineers who will fix it
  • Free retest of remediated findings, and a closure certificate

What We Usually Find

Not a list of everything possible — the things that come up again and again, in roughly the order they come up.

  • Authentication that is sound at the front door and absent on the API behind it
  • Access control enforced in the interface but not in the endpoint it calls, so changing an ID in a request returns another customer's data
  • Credentials and API keys in client-side code, mobile app bundles or public repositories
  • Old versions of frameworks and libraries with published exploits, usually in a service nobody owns any more
  • Internal services reachable from the internet because a firewall rule was added temporarily and never removed
  • Session handling that does not invalidate on logout or password change
  • Error messages and debug endpoints that disclose internal paths, versions and database structure

How the Engagement Runs

  1. Scope and authoriseAgree targets, windows and written authorisation.
  2. TestAutomated discovery, then manual exploitation and verification.
  3. ReportEvidence, impact and remediation, triaged by priority.
  4. RetestConfirm fixes and issue the closure certificate.

Questions We Are Asked

What is the difference between VA and PT?

A vulnerability assessment enumerates weaknesses, largely with tooling, and is broad and shallow. A penetration test attempts to exploit them and chains them together, and is narrow and deep. VAPT as sold in India usually means both, but the proportions vary enormously between providers. Ask what share of the engagement is manual.

How long does a VAPT engagement take?

Two to six weeks for most scopes, including reporting and a retest. A single web application is at the short end; an estate with several applications, an API and an internal network is at the long end. Anyone quoting a fixed week for an unseen scope is quoting a scan.

Will testing take our systems down?

Not with a competent tester and an agreed scope. Denial-of-service testing is excluded by default and only included if you ask. We agree testing windows, rate limits and an escalation contact before anything starts, and we stop immediately if something behaves unexpectedly.

Do you test against production or staging?

Production where it is safe, because staging rarely matches it. Where production testing is genuinely too risky we test staging and say so in the report, including what that means for the confidence of the findings.

Do you provide a certificate after the test?

We provide a report and, where a customer or auditor needs one, a letter of attestation stating the scope, dates and methodology. Be cautious of anyone selling a security certificate for a penetration test; no accredited scheme issues one.