Overview
Indian estates often spread across a primary data centre, a disaster recovery site in another city, cloud regions in Mumbai or Hyderabad and a few hosting accounts nobody remembers opening. Attackers scan all of it. We begin by confirming what you really expose, then test VPN gateways, remote-access portals, mail and web services by hand. Reports list the dates and IP ranges covered, which is what auditors ask to see first.
An external test starts with honest discovery, because organisations rarely have a complete picture of what they expose. We enumerate the hosts, services, domains and forgotten assets reachable from the internet, then compare that against what you believe is in scope. Shadow infrastructure, a staging box left public or an exposed admin panel is often where the real risk sits, and finding it is half the engagement.
With the perimeter mapped we test each exposed service for the weaknesses that matter: default or weak credentials on remote access, VPN and firewall gateways; outdated software with known vulnerabilities; misconfigured mail, DNS and web services; and authentication that can be brute-forced or bypassed. We work carefully and avoid denial of service, because the point is to demonstrate a realistic route in, not to knock your services over.
The report is organised around that question of access. Rather than a flat list of open ports, you receive findings grouped by the risk they create, each scored with CVSS v4.0 and accompanied by evidence and a fix. Where several low-severity issues combine into a plausible path to internal access, we show the chain, because that is how real intrusions happen and how your remediation should be prioritised.
How we work with Indian clients
- Fixed-price proposals in INR, with 18% GST shown separately on every invoice
- Remote-first delivery from Ahmedabad in IST working hours; on-site work can be discussed at scoping
- Signed authorisation, an NDA on request and agreed testing windows before any activity begins
- Reports and closure evidence shaped for RBI, SEBI CSCRF, IRDAI, DPDP, ISO 27001 and PCI DSS reviews
What's included
Our approach
- Scope & authorisationWe confirm ranges and gain written authorisation before any testing.
- DiscoveryWe enumerate the full internet-facing surface, including assets you may have missed.
- Service testingEach exposed service is assessed for configuration and known weaknesses.
- ExploitationWe safely demonstrate access where it exists, avoiding disruption to live services.
- Report & debriefFindings are grouped by route-to-access, scored and explained to your team.
What you receive
- Inventory of discovered internet-facing assets
- Risk-rated findings grouped by route to access
- CVSS v4.0 scores and prioritised remediation
- Illustrative evidence of any access achieved
- Free retest of fixed issues and an attestation letter
Standards & frameworks
- PTES
- NIST SP 800-115
- OSSTMM
- MITRE ATT&CK
- CVSS v4.0
- CWE
- CERT-In Directions 2022
- RBI IT Governance Direction 2023
Frequently asked questions
What do you need to start an external test?
A list of in-scope IP ranges and domains, written authorisation to test them, and a technical contact. We confirm ownership of each range before testing and will flag anything we discover that looks related but was not on your list.
Will this disrupt our live services?
We design the engagement to avoid it. We exclude denial-of-service techniques, throttle intensive checks and schedule anything higher-risk with your team. A named contact can reach the tester throughout, so any unexpected behaviour is paused immediately.
How is this different from a vulnerability scan?
A scan lists potential issues from signatures; our testers confirm what is real, discard false positives, and chain findings into actual routes to access. You receive verified attack paths with evidence, not an unfiltered list that still needs triage.
Can internal and Active Directory testing be done without a site visit?
Usually, yes. We connect through a VPN you provide or a small preconfigured device that your team plugs in at the office. On-site work can be discussed at scoping where a network needs it.
Will you look at our CERT-In log and time-sync settings?
When infrastructure is in scope, we note whether logs appear to be kept for the 180 days the 2022 CERT-In Directions require and whether systems sync time with NIC or NPL servers. Treat this as a technical observation, not a legal opinion.