Overview
Indian auditors and regulators now ask for proof that VAPT findings were closed, not just the original report. SEBI's CSCRF, for example, expects VAPT findings to be closed within three months of the report being submitted. We retest each fixed issue, record the outcome against the original finding and issue closure evidence your auditor can file. Retesting our own findings is free; findings from another provider are quoted at scoping.
Remediation is where security testing either pays off or quietly fails. A fix can look complete in a ticket yet miss an edge case, address the symptom but not the cause, or introduce a new weakness while closing the old one. Retesting exists to replace the assumption that a fix worked with evidence that it did, by re-running the original issue against the updated system and confirming the behaviour that proved it is genuinely gone.
We treat each finding individually rather than rescanning the whole scope. Working from the original evidence, we reproduce the conditions that demonstrated the issue and check whether they still hold, recording each as resolved, partially resolved or still present. Partial fixes are common and matter: a control added in one place but not another, or input handled on one path but not a parallel one, leaves real exposure that a simple pass or fail would hide, so we describe exactly what remains.
The value is an honest, independent record of your current state. Because we validate against the specific findings, the outcome is unambiguous, and once the material issues are resolved we issue an attestation letter stating what was retested and confirmed. This service stands on its own, retesting findings from an earlier engagement whoever produced them, and it is the natural close to any test we run, where retesting fixed findings is already included at no extra charge.
How we work with Indian clients
- Fixed-price proposals in INR, with 18% GST shown separately on every invoice
- Remote-first delivery from Ahmedabad in IST working hours; on-site work can be discussed at scoping
- Signed authorisation, an NDA on request and agreed testing windows before any activity begins
- Reports and closure evidence shaped for RBI, SEBI CSCRF, IRDAI, DPDP, ISO 27001 and PCI DSS reviews
What's included
Our approach
- IntakeWe take the original findings and evidence and confirm what is ready to retest.
- RetestingEach finding is reproduced individually against the updated system.
- ClassificationWe record resolved, partial and open status with supporting evidence.
- ReportingResults are documented clearly, including any remaining exposure.
- AttestationOnce material issues are closed, we issue a shareable attestation letter.
What you receive
- Per-finding retest results with evidence
- Clear resolved, partial or open status for each issue
- Description of any remaining exposure
- Notes on regressions introduced by fixes
- Attestation letter you can share with customers and auditors
Standards & frameworks
- PTES
- NIST SP 800-115
- OWASP WSTG
- CVSS v4.0
- CWE
- SEBI CSCRF
- RBI IT Governance Direction 2023
- IRDAI Cyber Security Guidelines 2023
- CERT-In Audit Guidelines 2025
- DPDP Act 2023
Frequently asked questions
Can you retest findings from another provider?
Yes. This service is independent of who performed the original test. Give us the findings and their evidence and we will reproduce each one against your updated systems, which is often useful when you want a second, impartial confirmation that fixes hold.
What counts as a partial fix?
A fix that reduces but does not remove the exposure, for example a control added on one path but not a parallel one, or an input validated in one place but not another. We flag these explicitly, because a plain pass or fail would hide the real risk that remains.
Is retesting included in your other engagements?
Yes. Every test we run includes a free retest of fixed findings and an attestation letter. This standalone service is for retesting at a larger scale, validating another provider's findings, or revalidating long after the original engagement closed.
How often do Indian regulators expect VAPT?
It depends on the rulebook. RBI expects periodic VA/PT of critical and internet-facing systems, SEBI's CSCRF sets half-yearly VAPT for Qualified Stock Brokers, and CERT-In's 2025 guidelines call for at least one comprehensive audit a year. We help you build one calendar that covers each rule you report against.
Do you offer annual VAPT contracts?
Yes. Many Indian clients prefer a yearly agreement that covers two or more VAPT cycles plus retests, priced in INR with GST shown separately. Scope is reconfirmed before each cycle so the price stays accurate.