VAPT and penetration testing for Indian sectors

We apply the same testing method everywhere. The variables are the regulator looking over your shoulder, the data an attacker would sell and the hours your systems cannot go down. These six sections show how that shifts the scope of a VAPT for Indian organisations.

Banks, NBFCs, payment aggregators & insurers

Fraud in Indian financial services rarely starts with broken encryption. It starts with a loan limit enforced only in the app, a refund callback that can be replayed, a merchant onboarding form that skips a KYC step, or an agent portal that shows every customer in a branch. RBI's Master Direction on IT Governance, Risk, Controls and Assurance Practices, dated 7 November 2023 and effective from 1 April 2024, expects periodic VA/PT, particularly of internet-facing and critical systems. IRDAI's Information and Cyber Security Guidelines of 2023 similarly expect insurers to carry out periodic assessments. Card payments add PCI DSS v4.0.1 Requirement 11.4.

• Lending, payout, refund and mandate logic tested under parallel requests
• Mobile banking, wallet and insurance apps checked against OWASP MASVS
• Payment aggregator, KYC and co-lending partner APIs tested for object-level authorisation
• Agent, branch and back-office portals reviewed for excess data exposure
• Closure evidence and attestation letters for RBI and IRDAI reviews

API VAPT for financial platforms

Stock brokers, AMCs & capital markets

SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF), issued in August 2024 with FAQs published in June 2025, puts VAPT and cyber audits at the centre of what market entities must show. Qualified Stock Brokers are expected to run VAPT every six months, and findings are expected to be closed within three months of the VAPT report being submitted. Where CSCRF specifies that application security testing must be done by a CERT-In empanelled auditor, note that we do not claim empanelment; raise it at scoping and we will tell you clearly whether we can meet that requirement.

• Trading apps, investor portals and back-office systems
• Thick client review of dealer terminals and order management tools
• A closure tracker aligned to the three-month CSCRF window
• Pre-audit VAPT so the formal cyber audit finds fewer surprises
• Testing windows planned outside market hours where production is involved

Thick client VAPT for trading platforms

SaaS companies & IT services exporters

Indian SaaS firms and IT exporters sell to overseas customers who send long security questionnaires and ask for a recent penetration test before signing. ISO/IEC 27001:2022 controls 8.8 and 8.29 and SOC 2 audits both lead auditors to look for regular testing evidence. Technically, the finding that ends deals is one tenant seeing another tenant's records, so that is where we spend most of the time.

• Tenant isolation across the interface, API, exports, webhooks and background jobs
• Support, admin and impersonation features
• SSO, SCIM and user invitation flows
• AWS, Azure or Google Cloud accounts and Kubernetes clusters behind the product
• A signed attestation letter for sales and procurement conversations

Web application VAPT for SaaS products

Healthcare & health-tech

Hospitals, diagnostic chains, telemedicine platforms and health-tech start-ups hold data that stays sensitive for a lifetime, and ransomware on a hospital network can delay treatment. Apps integrated with the Ayushman Bharat Digital Mission (ABDM) exchange health records with other participants, which widens the set of systems that must be trusted. The DPDP Act 2023 and the Rules notified on 13 November 2025 require reasonable security safeguards, such as encryption or masking, access control, monitoring with logs kept for at least a year, and backups. Most of those obligations apply from 13 May 2027.

• Patient apps, teleconsultation and appointment platforms
• ABDM-linked interfaces and lab or pharmacy integrations
• Segmentation between clinical, guest and corporate networks
• Access control and logging checks that line up with DPDP safeguards
• Test windows agreed with clinical teams to avoid disruption

Internal network VAPT for hospitals

E-commerce & D2C brands

Online sellers in India lose money through business rules more often than through servers: stacked coupons, cash-on-delivery abuse, refund loops, referral fraud and order data that leaks to fake support callers. Accepting cards puts PCI DSS v4.0.1 in play for you or your payment partner, with Requirement 11.4 calling for penetration testing at least annually and after significant change. Customer data brings the DPDP Act. Big sale days are when weaknesses are most expensive, so test well before them.

• Cart, pricing, coupon, wallet and refund logic
• Account takeover through OTP, login and recovery flows
• Seller, logistics and marketplace partner APIs
• Scripts running on checkout and payment pages
• Admin panels and storage buckets exposed to the internet

API VAPT for marketplaces and D2C brands

Government, PSUs & CERT-In audited entities

Ministries, departments, public sector undertakings and their technology suppliers run citizen and vendor portals that attract defacement, data theft and disruption. CERT-In's Comprehensive Cyber Security Audit Policy Guidelines of 25 July 2025 apply to government and private auditee organisations, including those audited because RBI, SEBI or another regulator requires it. They call for at least one comprehensive audit a year, carried out only by CERT-In empanelled auditors. We do not claim empanelment. We can run pre-audit VAPT, help you fix what it finds and retest, and tell you at scoping whether we can meet any empanelment requirement.

• Citizen, vendor and employee portals
• Legacy applications running beside newer cloud services
• Supplier and system integrator remote access paths
• Readiness checks against CERT-In's 2022 logging and time-sync Directions
• Remediation support and retesting before the empanelled audit

CERT-In empanelled audit guide