Penetration testing services
Krylo Security tests web applications, APIs, mobile apps and networks by hand, the way attackers would. Each engagement combines a vulnerability assessment with manual penetration testing (VAPT), and every finding is reproduced by a tester before it reaches your report.
Choose what to test
Four kinds of penetration test, each with its own scope, methods and standards. Most clients combine two or more in one engagement.
Included in every engagement
- A free scoping call and a written quote
- A mutual NDA before you share anything
- Manual testing, supported by automated scanning
- Critical issues reported as soon as we confirm them
- A report for executives and one level deeper for developers
- A walkthrough of the results with your team
How an engagement runs
Five steps, from the first call to the clean exit. The same for every kind of test.
- Day 0
Scoping call
A free call to understand what you want tested and why: the applications, networks or APIs, your deadlines and any compliance requirement behind the test. You get a written quote with the scope, timeline and deliverables set out.
- Before testing
NDA and rules of engagement
We sign a mutual NDA, or work under yours, then agree the rules of engagement: targets, testing windows, contacts, and anything that must not be touched. Testing can start within 48 hours of the scope being signed.
- Testing
Hands-on testing
Our testers combine tools with manual testing, following OWASP, PTES and NIST SP 800-115. If we confirm a critical issue, we tell you straight away instead of waiting for the report.
- Report
Report and walkthrough
Every finding is reproduced by a tester before it goes in the report, with severity, evidence and a fix written for your stack. We walk your team through the results and answer questions.
- After
Retest and clean exit
When you have fixed the issues, we can retest and issue an updated report. When the engagement ends, we remove test accounts, credentials and working files, and confirm it in writing on request.
Planning a penetration test
Budget, timeline and compliance are usually the first questions. These pages answer them.
What a penetration test costs
The factors that set the price, typical market ranges, and how we quote.
How the process works
Every step from the scoping call to the retest, and what we need from you at each one.
Testing for compliance
What SOC 2, ISO 27001, PCI DSS, HIPAA and DORA expect from a penetration test.
By industry and market
The same four tests, aimed at the flaws and rules that matter most in your sector.
SaaS and SOC 2
Tenant isolation, roles and APIs, with a report for auditors and customer security reviews.
Fintech
Payments, ledgers, KYC and APIs, tested for the logic flaws that move money.
E-commerce
Checkout, accounts and payment pages, with reports for PCI DSS.
Healthcare
Patient portals, FHIR APIs and clinic networks, tested without real patient data.
VAPT in India
Testing for Indian companies, and what RBI, SEBI, CERT-In and the DPDP Act expect.
Every assessment follows recognised penetration testing standards, and the report is written to support SOC 2, ISO/IEC 27001, PCI DSS, HIPAA and GDPR evidence requests.
Common questions
What is the difference between VAPT and penetration testing?
VAPT stands for vulnerability assessment and penetration testing. The assessment finds and lists weaknesses, mostly with automated scanning. The penetration test goes further and proves which of them an attacker could exploit. Every Krylo Security engagement includes both: we scan for known issues, then test by hand, and only findings we have confirmed reach your report.
Which type of penetration test do we need?
Start with what you want to protect. If customers use a web application, start there. If you publish APIs or have a mobile app, test those, because they are often where the most serious issues are. If you are worried about ransomware or an attacker inside the network, choose a network test. Not sure? Book a scoping call and we will recommend a scope.
Do you work with companies outside India?
Yes. Krylo Security is based in West Bengal, India, and we test for organisations worldwide. Testing is done remotely, and we schedule calls around your time zone.
How quickly can you start?
Testing can start within 48 hours of the scope being signed. How long it lasts depends on the size of the scope, and your quote states the timeline.
Start your security assessment.
Tell us about your application, architecture or compliance requirements. Our team will scope a penetration test around them.