Overview
Indian SaaS and fintech teams often release several times a week while their compliance calendar still asks for one VAPT a year. Continuous testing closes that gap. A known team reviews new features as they ship, raises findings as soon as they are confirmed and retests fixes in the same cycle. The engagement is priced as a fixed quarterly or annual fee in INR, with GST added, and scope is reviewed every quarter.
A point-in-time test is accurate on the day it ends and increasingly stale thereafter. Modern applications ship changes every week, and each release can introduce risk that a yearly assessment will not see for months. Continuous pentesting, often sold as penetration testing as a service, replaces that single snapshot with an ongoing programme: testing cadence through the year, triggered assessments when significant changes ship, and a running view of your security posture rather than a document in a drawer.
The engagement model is what makes it work. A defined scope is tested on a recurring basis by the same testers who come to know your applications, and new findings appear in a live portal as they are confirmed, not weeks later in a PDF. You can request focused tests when you release a major feature, and fixes are retested quickly so a closed finding is genuinely closed. Critical issues are alerted in real time, keeping the programme responsive to how you actually build and deploy.
This suits teams shipping continuously and those who want to show customers and auditors that testing is ongoing rather than annual. It complements point-in-time work rather than replacing it: a deep VAPT or red team still has its place, while continuous testing keeps pace between them. We agree the scope, cadence and portal access up front, and the programme flexes as your applications and priorities change.
How we work with Indian clients
- Fixed-price proposals in INR, with 18% GST shown separately on every invoice
- Remote-first delivery from Ahmedabad in IST working hours; on-site work can be discussed at scoping
- Signed authorisation, an NDA on request and agreed testing windows before any activity begins
- Reports and closure evidence shaped for RBI, SEBI CSCRF, IRDAI, DPDP, ISO 27001 and PCI DSS reviews
What's included
Our approach
- OnboardingWe agree scope, cadence, portal access and how releases trigger testing.
- Baseline testAn initial assessment establishes the starting posture for the programme.
- Continuous testingRecurring and change-triggered testing runs through the year.
- Portal & alertsFindings appear live, with critical issues alerted in real time.
- Review & retestFixes are retested quickly and the programme is reviewed and adjusted.
What you receive
- Live portal of findings, status and history
- Recurring and change-triggered test reports
- Real-time alerts for critical findings
- Fast retests whenever fixes are deployed
- Evidence of ongoing testing for customers and auditors
Standards & frameworks
- OWASP WSTG
- OWASP ASVS
- OWASP API Security Top 10
- PTES
- NIST SP 800-115
- CVSS v4.0
- SEBI CSCRF
- RBI IT Governance Direction 2023
- IRDAI Cyber Security Guidelines 2023
- CERT-In Audit Guidelines 2025
- DPDP Act 2023
Frequently asked questions
Does continuous testing replace an annual pentest?
It replaces the idea that one yearly test is enough, but deep point-in-time work still has value. Many teams run continuous testing for coverage between releases and commission a focused VAPT or red team periodically. We help you choose the mix that fits how you ship.
How is this priced against a one-off test?
It is a programme rather than a single engagement, scoped by the applications covered and the cadence you want. Because testing is spread across the year, it is planned as an ongoing arrangement; we size it to your release pace during onboarding.
Can you test around our release schedule?
Yes. That is the point. We align testing with how you ship, running focused assessments when significant features go out and keeping a recurring baseline between them, so new risk is found close to when it is introduced.
How often do Indian regulators expect VAPT?
It depends on the rulebook. RBI expects periodic VA/PT of critical and internet-facing systems, SEBI's CSCRF sets half-yearly VAPT for Qualified Stock Brokers, and CERT-In's 2025 guidelines call for at least one comprehensive audit a year. We help you build one calendar that covers each rule you report against.
Do you offer annual VAPT contracts?
Yes. Many Indian clients prefer a yearly agreement that covers two or more VAPT cycles plus retests, priced in INR with GST shown separately. Scope is reconfirmed before each cycle so the price stays accurate.