VAPT services for Indian companies
Krylo Security is a penetration testing company based in West Bengal. We run vulnerability assessment and penetration testing for Indian businesses: a scan for known weaknesses, then days of manual testing to prove which ones an attacker could use. Only findings we have confirmed reach your report.
Who asks for VAPT in India
The reason you need a test decides its scope and its report. These are the requests we see most. Always check the current circular from your own regulator, because frequencies and auditor requirements change.
| Who is asking | What they expect |
|---|---|
| RBI-regulated banks and NBFCs | Periodic VAPT of internet-facing and critical systems under the RBI's cyber security and IT governance directions, with findings tracked to closure. |
| SEBI-regulated entities | VAPT under SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF, 2024). How often depends on the category your entity falls into. |
| Every organisation in India | CERT-In's April 2022 directions require many cyber incidents to be reported within six hours and logs to be kept for 180 days. Testing first is the cheaper way to find the gaps. |
| Anyone handling personal data | The Digital Personal Data Protection Act, 2023 requires reasonable security safeguards to prevent breaches. Penalties for failing to take them go up to ₹250 crore. |
| Customers abroad | Buyers in the US, UK and Europe ask Indian vendors for a recent penetration test report, often alongside SOC 2 or ISO 27001 evidence. |
What a Krylo Security VAPT covers
VAPT is two jobs. The vulnerability assessment finds and lists known weaknesses, mostly with automated scanning. The penetration test goes further: a tester tries to exploit them, and looks for the access control and business logic flaws no scanner can see. We do both in every engagement.
Most Indian clients combine two or more of our tests: web applications, APIs, mobile apps and networks.
Some regulated audits must be carried out by a CERT-In empanelled auditor. If your circular says so, tell us on the scoping call and we will tell you plainly whether we are the right fit before you sign anything.
Every engagement includes
- A free scoping call and a fixed quote for that scope
- A mutual NDA before you share anything
- Testing that starts within 48 hours of a signed scope
- Critical issues reported as soon as we confirm them
- A report for management and a detailed one for developers
- A walkthrough of the results, and a retest if you ask for one
Related reading
Testing for compliance
What RBI, SEBI, CERT-In, SOC 2, ISO 27001 and PCI DSS expect from a penetration test.
What a test costs
The factors that set the price, typical market ranges, and how we quote.
Vulnerability assessment vs penetration testing
The two halves of VAPT, and when you need each.
VAPT questions
What is VAPT?
VAPT stands for vulnerability assessment and penetration testing. The assessment finds known weaknesses, mostly with automated tools. The penetration test proves which of them can be exploited and finds the logic flaws tools miss. A VAPT report should only list issues a tester has confirmed.
How often should an Indian company run VAPT?
At least once a year, and after significant changes such as a new application, a major release or an infrastructure move. Regulated entities follow the schedule their regulator sets, which can be more frequent for critical systems.
Do you work on-site?
Testing is done remotely, which covers web applications, APIs, mobile apps and external networks. For internal network tests we agree a secure way in, such as a VPN or a small testing device on your network.
Will we get a VAPT certificate?
You get a full report stating the scope, dates, method and every confirmed finding with its fix. After a retest we issue an updated report showing what is resolved, which is what auditors and customers usually ask to see. If your auditor needs a particular format, tell us at scoping.
How much does VAPT cost?
It depends on the scope: how many applications, roles, endpoints or hosts are tested, and how deep. The scoping call and the quote are free, and the quote states exactly what is included.
Start your security assessment.
Tell us about your application, architecture or compliance requirements. Our team will scope a penetration test around them.