Secure — Penetration Testing (VAPT)

Penetration testing that finds real issues and helps you fix them

Our penetration testing (VAPT) service finds security weaknesses in your web app, mobile app, APIs, network or cloud before attackers do. We test by hand using OWASP methods, write a report your developers can act on and retest for free within 30 days.

Get my quote on WhatsApp Prefer a call?

Mon–Sat · 9am–8pm IST

Starting from

₹25k

one-time · free retest included

Timeline

1–3 weeks

typical

After launch

Optional quarterly or release-based retests

Maulik Gupta

Founder & Lead Engineer · you'll talk to me

Sound familiar?

"Our biggest customer wants a pentest report before they renew."

An enterprise client, investor or app store review is asking for a VAPT report.
We ran a free scanner once and got 400 warnings, most of them noise.
Past reports listed problems but didn't tell our developers how to fix them.
We ship every week and have no idea if the new APIs opened a hole.
We handle payments or health data and need proof we take security seriously.

Built for

SaaS companies asked for a pentest report by enterprise customersFintech and payments apps handling money or KYC dataHealth-tech and e-commerce platforms storing personal dataStartups launching a new app or major releaseCompanies preparing for ISO 27001, SOC 2 or a regulator auditBusinesses with mobile apps on Android and iOS

What we do

What's included in Penetration Testing (VAPT).

Web Application Penetration Testing

Manual testing for the OWASP Top 10 and beyond: broken access control, injection, login and session flaws and business logic abuse.

Mobile App VAPT (Android & iOS)

Testing of the app, its local storage and its traffic using OWASP MASVS, including certificate pinning, root/jailbreak checks and API calls.

API Security Testing

REST and GraphQL APIs tested against the OWASP API Security Top 10, with a focus on one user reaching another user's data.

Network & Infrastructure Penetration Testing

External and internal testing of servers, firewalls, VPNs and exposed services to find open doors and outdated software.

Cloud Penetration Testing

Testing of AWS, Azure or GCP setups for exposed storage, over-powered roles and paths from a small foothold to full control.

Free Retest & Fix Support

After you fix the issues, we retest once within 30 days and update the report. We can also help your developers fix them.

Who delivers this

Senior security people, not juniors.

Every engagement is led and advised by our security team — a serving CISO with 31+ years in technology, and a partner with security experience across India, Europe and the USA.

Security & Compliance Partner

Leads this service

India · Europe · USA

A hands-on security specialist across India, Europe and the USA, covering cloud, privacy and penetration testing.

3 continentsCloud & privacy securityPublished IoT security researcherAzure security certified

GDPR · DPDP Act · Europrivacy · OWASP · Azure security · GRC

Principal Security Advisor

Advises

Serving CISO · 31+ years in technology

A serving CISO at a global European telecom and IT services group, with 31+ years of making security a business advantage.

Serving CISO31+ years in technologyMulti-country security governanceBoard-level risk reporting

ISO 27001 · NIST CSF · GDPR · NIS2 · Risk & governance

Pricing

Transparent packages. Fixed quotes.

Your final quote is fixed after a 20-minute call — no surprise bills.

Web App

from ₹25k

one-time · 1–2 weeks

One web application, up to ~25 key pages or flows
Manual testing to OWASP Top 10 and ASVS
Authenticated testing with two user roles
Developer-friendly report with fix steps
One free retest within 30 days

Get this quote

Mobile App

from ₹75k

one-time · per platform

Android or iOS app testing to OWASP MASVS
Local storage, traffic and binary checks
Backend API calls used by the app
Developer-friendly report with fix steps
One free retest within 30 days

Get this quote

Recommended

Web + API + Cloud

₹1.5L+

one-time · 2–3 weeks

Web application penetration test
API security testing
Cloud configuration and penetration test
Executive summary for leadership and customers
Findings walkthrough with your developers
One free retest within 30 days

Get this quote

Ongoing costs after launch

No surprises: here's everything you may pay every month, stated upfront.

With us

Optional quarterly or release-based retests

See all ongoing plans

Paid to third parties, at cost, no markup

Empanelled partner fees, only if a CERT-In empanelled report is required

—Where your regulator or customer requires a report from a CERT-In empanelled auditor, we coordinate testing with an empanelled partner firm. Their fee is quoted separately.
—Additional retests after the first free one are billed per day of effort.
—Fixing issues is quoted separately if you want us to do it.
—Cloud provider charges for any test environment are paid directly by you.

Want a quick estimate for your exact project? Try the cost estimator.

Process

From first message to launch.

Clear stages, a live preview link every week, and payments tied to milestones you approve.

Step 01Days 1–2
Scoping call
We agree the apps, environments and test accounts in scope, sign the NDA and rules of engagement, and fix the price.
Step 021–2 weeks
Testing
Automated scans plus hands-on manual testing, usually on staging. We alert you at once if we find anything critical.
Step 032–3 days
Report & walkthrough
A plain-language summary for founders and step-by-step technical detail for developers, walked through on a call.
Step 04Within 30 days
Fix & retest
Your team (or ours) fixes the issues. We retest once for free within 30 days and issue an updated report.

Technology

Tools we trust.

OWASP Top 10OWASP ASVSOWASP MASVSOWASP API Security Top 10PTESBurp SuiteNmapMobSFFridaNucleiProwlerCVSS

Our promises

Working with us is low-risk.

Fixed quote

A clear, fixed price after a 20-minute call. No surprise bills.

Pay in milestones

Projects: 40% to start, 30% on design approval, 30% at launch.

You own everything

Code, domain, ad accounts, WhatsApp number and data — in your name.

Weekly previews

See real progress on a live link every week, not just status updates.

30 days of free fixes

Anything not working as agreed after launch, we fix at no cost.

Talk to the builder

No account managers. You speak with the engineers doing the work.

FAQ

Questions, answered.

What decides the cost of a penetration test?+

The number of apps, pages, user roles and API endpoints, the platforms (web, Android, iOS) and whether cloud or network testing is included. We give a fixed price after a short scoping call.

How long does a VAPT take?+

Most web app tests take 1–2 weeks, and bundles take 2–3 weeks, including the report. The retest is usually done within a few days of you telling us the fixes are live.

Are you CERT-In empanelled?+

No. We are not a CERT-In empanelled auditor, and our reports don't claim to be. Many customers just need a solid independent pentest. Where a regulator or customer specifically requires an empanelled auditor's report, we coordinate testing with an empanelled partner firm.

Will testing break our live app?+

We prefer testing on staging. If we must test production, we agree safe hours, avoid destructive tests and stay in touch with your team throughout.

Will you sign an NDA, and what happens to our data?+

Yes. We sign an NDA and written rules of engagement before testing. Test data and findings are stored encrypted and deleted after the retest, unless you ask us to keep them.

What happens after the report?+

Your developers fix issues using the step-by-step guidance, or we fix them for you since we also build web and mobile apps. Then we retest once for free within 30 days and update the report you share with customers.

How often should we do a pentest?+

At least once a year, and after any major release or architecture change. CERT-In's July 2025 audit guidelines also expect at least annual security audits for covered organisations.