A scanner reports. We break in.
An automated scan tells you a parameter looks injectable. A penetration test shows you the 40,000 customer records it pulled out, the admin session it hijacked and the S3 bucket it reached from there. That gap — between a theoretical finding and a proven breach — is the entire point of hiring a human.
Roughly 70% of what we report on a typical engagement is invisible to scanners: broken object-level authorisation, business-logic abuse, race conditions in payment flows, tenant isolation failures and privilege escalation chains. Those are the findings that end up in breach post-mortems.
Every engagement is fixed-price, scoped in writing, and ends with a free retest so you can prove the holes are actually closed.
// illustrative output — client identifiers redacted
Nine kinds of penetration test.
Most clients start with one and expand. Each can be booked standalone or combined into a full-scope engagement.
Web app pen test
Full OWASP Top 10 and ASVS Level 2 coverage — injection, broken access control, SSRF, deserialisation, plus the business-logic abuse no scanner has a signature for.
iOS & Android pen test
Static and dynamic analysis against OWASP MASVS: insecure local storage, certificate pinning bypass, hardcoded secrets, root/jailbreak detection and the backend the app talks to.
REST & GraphQL pen test
Endpoint enumeration, BOLA and BFLA, mass assignment, rate-limit bypass, JWT flaws and GraphQL introspection abuse — mapped to the OWASP API Security Top 10.
External & internal
Perimeter testing from the internet and assumed-breach testing from inside the LAN: exposed services, weak credentials, SMB and Active Directory attack paths, lateral movement.
AWS / Azure / GCP
IAM privilege escalation paths, public storage, over-permissive roles, exposed metadata services, insecure defaults and misconfigured security groups.
Wi-Fi & RF
Rogue access points, WPA2/WPA3 handshake attacks, guest-network segmentation failures and captive-portal bypass across your office footprint.
Phishing & vishing
Authorised phishing, smishing and pretext calling campaigns that measure your real human attack surface — then feed the results into targeted staff training.
Full adversary simulation
Goal-oriented, multi-vector, low-and-slow simulation of a real threat actor. Tests your detection and response, not just your patch level.
Prompt & agent security
Prompt injection, tool-abuse and data-exfiltration testing for LLM features and autonomous agents — aligned to the OWASP Top 10 for LLM Applications.
Seven phases, every time.
Aligned to PTES, the OWASP Web Security Testing Guide and NIST SP 800-115 — so your auditor recognises the process and your engineers can follow the trail.
Scoping & rules of engagement
0.5 dayNDA signed, targets agreed, testing windows fixed, escalation contacts named and an authorisation-to-test letter executed. Nothing is touched before this document exists.
Reconnaissance
0.5–1 dayPassive and active intelligence: subdomain and asset discovery, technology fingerprinting, exposed credential checks against breach corpora, and public exposure mapping across code repos and cloud storage.
Scanning & enumeration
1 dayPort, service and application scanning to inventory the full attack surface, followed by manual enumeration of parameters, endpoints, user roles and trust boundaries that automation walks straight past.
Threat modelling
0.5 dayWe map the discovered surface against realistic attacker goals for your business — steal the customer database, move money, take over an account — so testing effort lands where a breach would actually hurt.
Exploitation
2–5 daysThe manual core of the engagement. Creative, chained exploitation to prove real impact: injection, broken access control, authentication bypass, race conditions and business-logic abuse.
Post-exploitation
0.5–2 daysWhere authorised, we demonstrate privilege escalation, lateral movement and how much data is actually reachable from the first foothold — the difference between “a bug” and “a breach.”
Reporting & retest
1.5 days + retestExecutive summary, CVSS v3.1 rated findings with proof of concept, developer-ready remediation, a live read-out call with your engineers, and a free retest to confirm the fixes hold.
A real trial audit, start to finish.
Before a full engagement we run a short, non-intrusive trial audit and hand back an audit trail: every issue logged, scored, tied to a business consequence and given a deadline. Below is that exact deliverable from a live assessment — client identity anonymised as Test Site.
These items are a sample from a short, non-intrusive trial scan. They show the kind of risk present rather than the full list. A complete audit finds, confirms and prioritises every issue across every system and regulation.
Understanding the environment
From publicly available signals alone we mapped this snapshot of the client's digital footprint. No credentials, intrusive scanning or exploitation were used to gather it.
This footprint tells us the client collects and stores personal data of website visitors — which brings it squarely within scope of India's DPDP Act 2023 and, for EU visitors, GDPR.
Security findings — the audit trail
A partial log of issues identified during the trial, each mapped to its business impact and a recommended remediation window.
| ID | Finding | Severity | CVSS | Business impact | Fix by |
|---|---|---|---|---|---|
| TA-01 | Missing HTTP security headers | CRITICAL | 9.1 | Clickjacking, injection & SSL-strip exposure of visitor data | 24 hrs |
| TA-02 | Email domain can be spoofed (no DMARC/DKIM) | CRITICAL | 9.3 | Business-email compromise & invoice fraud impersonating your brand | 24 hrs |
| TA-03 | Unprotected contact-form endpoint | HIGH | 8.6 | Spam floods & poisoned lead data; infrastructure abused on your behalf | 7 days |
| TA-04 | No HTTPS enforcement (SSL stripping) | HIGH | 8.2 | Session interception & data capture on untrusted networks | 7 days |
…and more. This is a partial trial log — additional findings across TLS configuration, consent handling, information disclosure and resource integrity are withheld from this preview and confirmed in the full engagement.
Potential penalties & business consequences
Left unaddressed, gaps like these expose a business to statutory penalties alongside direct commercial harm. Figures below are statutory maximums — indicative of exposure, not assessed fines.
| Framework | What can trigger it | Maximum exposure |
|---|---|---|
| DPDP Act 2023 | Failure to take reasonable security safeguards to prevent a data breach | Up to ₹250 crore |
| DPDP Act 2023 | Failure to notify the Data Protection Board & affected users of a breach | Up to ₹200 crore |
| GDPR (EU visitors) | Processing personal data without a lawful basis or valid consent | €20M or 4% of global turnover |
| IT Act 2000 §43A | Negligence in handling sensitive personal data causing wrongful loss | Uncapped compensation |
Beyond fines: mandatory breach disclosure, loss of client contracts and remediation under deadline — typically far costlier than fixing proactively.
Compliance observations
…further observations under the IT Act & SPDI Rules and PCI-DSS relevance are reserved for the full assessment.
Why this matters now
These findings are practical, not hypothetical. Each one points to an attack that takes little effort to carry out, and to a legal obligation that already applies. The good news: most of what a trial audit surfaces is inexpensive to fix and removes a large share of the risk.
Request a free trial audit for your site →This is exactly what your quotation looks like.
No “contact us for pricing.” Below is a real, unedited BytePatch quotation format for a mid-sized SaaS web application and its API — line items, tester-days, day rate, taxes and terms. Your numbers change with scope; the structure does not.
Sample figures for illustration. Your quotation is issued after a free 30-minute scoping call — book one here or build a rough number yourself with the instant estimate tool.
Penetration testing cost in India.
Starting prices in INR, exclusive of GST, at standard delivery. Final quote is fixed after a free scoping call.
- ✓Automated + manual vulnerability assessment
- ✓OWASP Top 10 coverage, single web app
- ✓CVSS v3.1 rated findings report
- ✓Remediation recommendations
- ✓45-minute read-out call
- ✓Turnaround: 3–5 working days
- ✓Everything in Full Manual, plus:
- ✓Web + mobile + API + cloud + network
- ✓Threat modelling & architecture review
- ✓Assumed-breach / lateral movement testing
- ✓Compliance mapping (DPDP / ISO 27001 / SOC 2)
- ✓Executive board report + IR readiness review
What one finding looks like.
Every issue in your report is written like this: scored, evidenced, reproducible, and closed with a fix a developer can actually ship.
Five deliverables, not one PDF.
Executive summary
Two pages your board, your insurer and your biggest client can all read. Risk posture, business impact and the three things to fix first — no jargon.
Technical findings report
Every issue with a CVSS v3.1 vector, CWE reference, OWASP mapping, reproduction steps and screenshot or request/response proof of concept.
Remediation plan
Prioritised by real risk, not scanner severity. Written for the developer who has to close it, with code-level guidance for your actual stack.
Read-out call
A live session with your engineering team to walk the findings, answer questions and agree the fix order before anyone opens a ticket.
Retest & attestation
We retest the remediated findings free within 30 days and issue a retest letter you can hand to clients, auditors and procurement teams.
Evidence destruction
All collected evidence and client data is destroyed 30 days after sign-off, confirmed to you in writing. Your data does not live on our disks.
Tools we test with.
Industry-standard offensive tooling, plus the custom scripts we write for your specific stack. Tools find the surface; the tester finds the breach.
Findings your auditor accepts.
Every finding is mapped to the frameworks you actually get assessed against, so one test satisfies several obligations at once.
Penetration testing, answered.
How much does a penetration test cost in India?
A focused assessment of one web app starts at ₹16,000. A full manual grey-box test typically runs ₹35,000–₹90,000 depending on roles, endpoints and logic flows in scope. Full-scope engagements start around ₹64,000. We quote a fixed price after a free scoping call — no hourly surprises.
VAPT vs penetration test — what's the difference?
VAPT bundles two things. The vulnerability assessment is broad and mostly automated. The penetration test is narrow and manual — a human exploits those weaknesses, chains them and proves business impact. Most compliance regimes want both.
How long does it take?
A single web app is 5–10 working days from kickoff: 3–6 days testing, 1–2 days reporting, then the read-out. Full-scope engagements run 3–6 weeks. The retest is scheduled separately and usually takes a day.
Do you need our source code?
No. Most engagements are grey box — you give us test credentials per role and we work from outside like an attacker with a valid account. White-box access finds more, faster, and we recommend it for high-risk systems, but it's optional.
Will testing take our production site down?
No. DoS and load testing are explicitly out of scope unless commissioned. We throttle automation, agree testing windows in writing, and run anything potentially intrusive only with your written approval. Where staging mirrors production, we prefer to test there.
Is penetration testing legal in India?
Yes — when authorised. Unauthorised access is an offence under Sections 43 and 66 of the IT Act, 2000. Every engagement starts with a signed authorisation-to-test letter and written rules of engagement. We never test an asset you can't demonstrate authority over.
How often should we test?
At minimum annually, and after any major release, architecture change, cloud migration or acquisition. SOC 2 and ISO 27001 programmes generally expect an annual test plus a retest. Fast-shipping product teams often move to quarterly.
Do you help us fix what you find?
Yes. Every finding ships with remediation written for the developer who has to close it. We run a read-out call, stay available during remediation, and retest the fixes free within 30 days.
Related services & guides.
Ethical Hacking Services
Red-team engagements, phishing simulations and adversary emulation from certified ethical hackers.
Read more →Cyber Security Services
The full security programme — audits, threat modelling, zero-trust design, compliance and incident response.
Read more →OWASP Top 10 Explained
A practical developer's guide to the ten risks we test for on every web application engagement.
Read more →Find it before they do.
Free 30-minute scoping call, a fixed-price quotation within 24 hours, and an NDA signed before a single detail is shared.