Author

Pragya Dwivedi

Name: SecureRoot Risk Advisory LLP, Branch Office
Address: 1027, Tower 3, Golden-I, Plot No. 11, Sector Tech Zone IV, Amrapali Leisure Valley, Greater Noida West, Uttar Pradesh, 201318, IN
Telephone: +91-7307148874
Price range: ₹50,000-₹8,00,000

Pragya Dwivedi is an Associate Director at SecureRoot Risk Advisory LLP. She holds the CISM and eWPTX certifications and works across security governance and advanced web application penetration testing, translating findings into fixes that hold up in audits and in production.

Book a Scoping Call About SecureRoot

Credentials

CISM
eWPTX

Associate Director: SecureRoot Risk Advisory LLP

Articles by Pragya Dwivedi

Guidance written up from the engagements this author scopes and delivers.

All Articles

Penetration Testing16 min read
CERT-In Incident Reporting: The Six-Hour Runbook
The CERT-In Directions give you six hours from noticing a listed incident. This is the execution side: what starts the clock, which of the 20 Annexure I types are reportable, the channels and fields, who is allowed to submit, and what to send when the facts are still moving at hour five.
September 19, 2026Read Article
Penetration Testing13 min read
How Often Should VAPT Be Done? Annual Baseline, Change Triggers and Regulator Cadence in India
Once a year is the floor, not the plan. This guide sets out when VAPT must be repeated after change, what RBI, SEBI, IRDAI and PCI DSS each require, and how to set a risk-based cadence by asset type.
September 17, 2026Read Article
Penetration Testing14 min read
CERT-In Directions Compliance in India: 6-Hour Reporting, Logs and NTP
The CERT-In Directions of 28 April 2022 apply to almost every organisation running ICT systems for Indian users. This guide walks through each obligation, what CERT-In's own FAQs clarify, and how VAPT and log monitoring make the 6-hour clock achievable.
September 17, 2026Read Article
Penetration Testing12 min read
API Security Testing Services: OWASP API Top 10 Coverage and Retesting
APIs fail on authorisation and business logic far more than on classic injection bugs, and a scanner cannot tell whether one tenant can read another's data. This guide sets out what a manual API security test covers, how each OWASP API Security Top 10 category is tested, what the report and the verified retest contain and what an engagement costs.
September 10, 2026Read Article
Managed SOC12 min read
Managed SOC Services in India: What 24/7 Monitoring Actually Includes
Managed SOC proposals all promise 24/7 monitoring. What that phrase covers varies enormously, from an alert-forwarding service to analysts who investigate, contain and report. This guide sets out the six things a managed SOC should include, how to compare it with building your own, and what to ask before signing.
September 8, 2026Read Article
Phishing Simulation11 min read
Phishing Simulation Services in India: Process, Metrics and Cost
The average click rate for untrained employees sits at roughly 33 percent. After a year of regular simulation and training, organisations typically get that under 5 percent. Those two numbers are why phishing simulation exists as a service category. They are also why most programmes stall. …
August 19, 2026Read Article
Cloud Security11 min read
AWS Cloud Security Audit Checklist for Indian SaaS Teams
Most AWS security checklists you will find were written for a US audience. They cover IAM hygiene and public S3 buckets well, and they say nothing about the two requirements that will actually appear in your next India audit: a six hour incident reporting clock and …
August 19, 2026Read Article
Penetration Testing9 min read
Red Team vs Penetration Testing: Key Differences Explained
The terms get used interchangeably, but red team vs penetration testing is a real distinction. One measures how vulnerable a system is; the other measures how well your organisation detects and responds to a determined attacker.
August 9, 2026Read Article
Penetration Testing9 min read
Types of Penetration Testing: A Complete Guide
Not all security tests are the same. The types of penetration testing differ by how much the tester knows and what they target – and choosing the right one decides whether a test finds real risk or just ticks a box.
August 7, 2026Read Article
DevSecOps9 min read
DevSecOps Best Practices: Build Security Into Every Release
Security bolted on at the end slows releases and misses flaws. DevSecOps best practices fix that by building security into every stage of development – so teams ship faster and safer at the same time.
July 14, 2026Read Article
Penetration Testing9 min read
OWASP Top 10 Vulnerabilities Explained (With Fixes)
If you build or run web applications, the OWASP Top 10 vulnerabilities are the risks most likely to get you breached. They represent the consensus of the global security community on where web apps fail most often.
July 10, 2026Read Article
Cloud Security24 min read
Cloud Security Best Practices: A Practical 2026 Guide
Most cloud guides stop at advice. This one names the control, gives the command on all three providers, maps it to the CIS Benchmark and NIST CSF item an auditor will ask for, and adds the India layer that global guides leave out.
July 7, 2026Read Article
Penetration Testing11 min read
Penetration Testing Cost in India: 2026 Pricing Guide
Real numbers, not a sales pitch. Indicative penetration testing price ranges by engagement type, the five factors that move a quote, and the warning signs of a test priced too low to be real.
July 5, 2026Read Article