VAPT and penetration testing that proves what an attacker could reach.
We test web apps, APIs, mobile apps, cloud and Active Directory by hand for Indian banks, brokers, SaaS exporters and online brands. You get evidence, fixes and closure records your auditor and your engineers can both work with.
- Manual testing, not a relabelled scan
- Fixed price in INR, GST shown separately
- Retest of fixed findings at no charge
- Critical issues flagged the day we confirm them
PATCH /limitsFlagged/docs/{id}Open/verifyFixed/api/v1FixedIllustrative only. No real client data.
Indian rules and global methods we map our reports to
- CERT-In Directions 2022
- CERT-In Audit Guidelines 2025
- RBI IT Governance Direction
- SEBI CSCRF
- IRDAI Cyber Security Guidelines
- DPDP Act 2023
- OWASP WSTG
- OWASP API Top 10
- OWASP MASVS
- CVSS v4.0
- PCI DSS v4.0.1
- ISO/IEC 27001:2022
Four practices, twenty kinds of test
We do not sell monitoring, licences or hardware. Every service is hands-on testing, from one partner API to a red team that runs for several weeks.
Application Testing
Web apps, APIs, mobile and desktop clients, source code and AI features, tested role by role for the flaws automated tools overlook.
Infrastructure & Cloud
Perimeter, internal networks, Active Directory, cloud accounts, Kubernetes, Wi-Fi and connected devices.
Adversary Simulation
Objective-led red teaming, people-focused social engineering and collaborative purple team exercises.
Testing Programmes
Combined VAPT, year-round continuous testing, audit-driven pentests and verification of your fixes.
The rules that shape VAPT in India
Most Indian buyers test because a regulator, an auditor or a large customer asks for it. Here is what each rulebook says about testing, in brief.
CERT-In Directions, April 2022
Report specified incidents within six hours, keep ICT logs for 180 days within India and sync clocks with NIC or NPL time servers.
CERT-In audit guidelines, July 2025
A comprehensive audit at least once a year by an empanelled auditor. We do not claim empanelment, but we help with pre-audit VAPT and readiness.
Read the guideRBI IT Governance Direction
In force since April 2024 for regulated entities, with periodic VA/PT expected, especially for internet-facing and critical systems.
SEBI CSCRF
VAPT and cyber audits for market entities, half-yearly VAPT for Qualified Stock Brokers and findings closed within three months of the report.
IRDAI guidelines, 2023
Insurers are expected to run periodic security assessments of their systems and the partners connected to them.
DPDP Act and Rules
Reasonable security safeguards for personal data, most obligations applying from 13 May 2027, and penalties of up to ₹250 crore for failing to take them.
From the first call to closure evidence
Each step ends with a dated document and a named person accountable for it, so the audit file grows as the work moves on.
- Scope
Targets, roles and environments listed, then sized in tester-days and priced in INR.
- Authorise
You sign the rules of engagement: windows, source IPs, exclusions and escalation contacts.
- Test
Manual testing in IST hours, with critical findings shared as soon as they are confirmed.
- Report
Rated findings, evidence, fixes and a management summary, explained on a debrief call.
- Close
We retest your fixes at no charge and issue closure evidence plus an attestation letter.
Findings a developer can fix and an auditor can file
Each issue names the affected endpoint or host, shows the evidence, explains the business impact and gives a fix suited to your stack. We score with CVSS 4.0 and then adjust the priority for what the system holds and who can reach it.
- Steps to reproduce and screenshots for every finding
- Remediation advice written for your framework and platform
- CWE and OWASP references for each issue
- A closure column your auditor can read at a glance
Sample finding · Illustrative
See a likely VAPT budget before any call
The calculator converts your scope into tester-days and an INR range based on published 2026 Indian market rates. Choose the tests, set their size, and watch how black-box testing or a rushed start shifts the figure. GST at 18% is added on top.
What changes the number
A VAPT team that does nothing but testing
Many Indian VAPT offers are a scanner export with a new cover page. Testers who only test spend their days on the flaws that tools cannot judge.
Each role, each tenant
We log in as every user type you have and try to step across the boundaries between them.
Attack paths
Three modest findings linked into one route to customer data outrank a long list of trivia.
Current stacks
UPI integrations, GraphQL, Kubernetes, Entra ID and LLM features are routine work for us.
Only confirmed issues
A tester has reproduced every finding in the report. Unverified scanner output stays out.
A VAPT report maps your weak points. We guard it accordingly.
A list of your weaknesses is valuable to an attacker. These safeguards apply to every engagement, large or small.
How we look after engagement data
- Testing starts only after your signed written authorisation
- Sign a mutual NDA first if you prefer, before sharing anything
- Evidence stored encrypted and limited to the assigned testers
- Reports shared through a controlled channel, not as loose attachments
- Test accounts and credentials returned or disabled when we finish
- Working files deleted at the end of the retention period we agree
Fixed INR price
Scope and price are agreed in writing, with GST shown separately, before testing starts.
Free retest
When you have fixed the reported issues, we confirm the fixes without an extra fee.
Same-day critical alerts
A confirmed critical goes straight to your nominated contact, not into a later report.
Reply in one business day
A consultant answers every enquiry within one business day, Indian time.
Where we focus depends on your regulator and your data
Payment flows, trading platforms, tenant data, health records or citizen portals each need a different emphasis.
Banks, NBFCs, payments & insurance
Money movement, lending journeys and RBI or IRDAI expectations.
Brokers & capital markets
Trading apps, dealer terminals and SEBI CSCRF timelines.
SaaS & IT exporters
Tenant isolation and evidence for SOC 2, ISO 27001 and client reviews.
Healthcare & health-tech
Patient data, ABDM-linked apps and DPDP safeguards.
E-commerce & D2C
Checkout logic, COD and coupon abuse, PCI DSS scope.
Government & PSUs
Citizen portals and pre-audit VAPT before a CERT-In audit.
Read this before you buy a VAPT
Costs in rupees, CERT-In audits, scoping and closure, written by people who run the tests.
How Much Does VAPT Cost in India?
Indicative 2026 VAPT prices in India by test type, what drives tester-days, how 18% GST applies and the red flags that mark a quote as a…
Read articleCERT-In Empanelled Audits and the 2025 Audit Policy Guidelines
What CERT-In's July 2025 audit policy guidelines expect from auditees, which audit types they cover and how to prepare with pre-audit…
Read articleHow Often Should You Run a Penetration Test?
How often Indian organisations should run VAPT: annual baselines, change-driven tests and the cadences set by CERT-In, RBI, SEBI CSCRF and PCI…
Read articlePentest RFP Questions That Separate Strong Providers from Weak Ones
Questions for an Indian VAPT tender or RFP: method, manual effort, reporting, retests, data handling, GST and how to verify any CERT-In empanelment…
Read articleFrom Report to Resolved: Remediation and Retesting After a Pentest
How Indian teams turn a VAPT report into closed findings: triage, owners, deadlines, retest scope and the closure evidence RBI and SEBI auditors…
Read articleHow to Scope a Penetration Test Without Wasting Tester-Days
How Indian teams can scope a VAPT that answers real risk questions: list assets, include vendor-hosted systems, agree testing windows and estimate…
Read articleQuestions Indian buyers ask us
Is VAPT the same thing as a penetration test?
Not quite. VAPT pairs a vulnerability assessment, which covers breadth with tooling, with a penetration test, where people prove which weaknesses can really be exploited. Indian tenders and audit checklists use the term widely. Our VAPT service always includes the manual half.
How much does VAPT cost in India?
Published 2026 ranges start around ₹40,000 for a small static website and run past ₹12,00,000 for a large multi-tenant SaaS platform, plus 18% GST. Effort in tester-days sets the price. Try the cost calculator or read our VAPT cost guide.
Are you a CERT-In empanelled auditor?
No, we do not claim CERT-In empanelment. If your audit, regulator or contract requires an empanelled auditor, raise it at scoping and we will tell you clearly whether we can meet it. We can still run pre-audit VAPT and help you fix and retest. See our CERT-In audit guide.
Where is your team based, and when do you work?
Our team is in Ahmedabad, Gujarat, and works Indian business hours (IST). Delivery is remote-first, over VPN or a small test device for internal networks. On-site work can be discussed at scoping where a test needs it.
Will your report satisfy RBI, SEBI, IRDAI or ISO 27001 reviewers?
Reports set out scope, dates, method and CVSS-rated findings with evidence and fixes, followed by closure evidence after the retest. We map findings to the obligations you name at scoping. Read how an engagement runs for each deliverable.
Who operates PentestProviders India?
BugFoe Private Limited runs it. The company was incorporated in India in 2021, works from Ahmedabad, and uses the PentestProviders name for its penetration-testing work. More on the about page.
Ready to find your risks before attackers do?
Tell us what you need tested or monitored. A senior consultant replies within one business day with a scoped, fixed-price proposal.
- Fixed-price proposal
- Reply within 1 business day
- NDA on request