Skip to content

ISO 27001, SOC 2, the DPDP Act and manual VAPT. Book a Free Scoping Call

Buyer's guide

How to Choose a VAPT Company in India: Criteria, Questions and an Honest Comparison

VAPT companies in India fall into five types: CERT-In empanelled auditors, large consultancies, specialist testing firms, scanning platforms and individual testers. Which one you may hire depends on your regulator first, then on nine checks that separate a test from a scan. SecureRoot Risk Advisory LLP is a specialist testing firm, so this page states our limits too. The first: we are not CERT-In empanelled.

Request an assessmentBook a 30-45 minute scoping call

Start a scope

SecureRoot’s own management system holds ISO/IEC 27001:2022 certificate IN60432E. SecureRoot is not a CERT-In empanelled auditor; where your regulator requires one, that auditor signs.

Start here

Must the report come from a CERT-In empanelled auditor?

Start with your regulator, not price or a top-10 list. It decides which provider types are eligible. Read the clause before you shortlist, because the wording moves with each circular.

  • SEBI

    CSCRF circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 (20 Aug 2024) and FAQs (11 Jun 2025)

    Cadence
    Yearly from Q1; half-yearly for regulated entities with critical information infrastructure or protected systems and for Qualified Stock Brokers; after major releases for most entities
    Who may test
    A CERT-In empanelled information security auditing organisation for audits and VAPT, unless the framework says otherwise. Self-certification entities are included for VAPT
    Empanelment mandatory?
    Yes

  • IRDAI

    Information and Cyber Security Guidelines, 2026

    Cadence
    Periodic vulnerability assessments, penetration testing and audits. Read the circular for the cadence that binds you
    Who may test
    Read the circular. We have not been able to confirm the Annexure B wording from a primary source
    Empanelment mandatory?
    Read the circular

  • RBI

    Cybersecurity, Technology: Risk, Resilience and Assurance Framework Directions, 2026, for banks, small finance banks and NBFCs (31 Jul 2026)

    Cadence
    Vulnerability assessment every six months and penetration testing every 12 months for critical and customer-facing DMZ systems
    Who may test
    “Independent information security experts or auditors”
    Empanelment mandatory?
    Not stated

  • PCI SSC

    PCI DSS v4.0.1, Requirements 11.3 and 11.4

    Cadence
    Penetration testing every 12 months and after significant change (11.4.2, 11.4.3); segmentation tests every 12 months (11.4.5)
    Who may test
    A “qualified tester with organisational independence”; an Approved Scanning Vendor for quarterly external scans (11.3.2)
    Empanelment mandatory?
    No. The ASV rule covers scans only

  • CERT-In

    Directions under section 70B(6) of the IT Act (28 Apr 2022)

    Cadence
    No VAPT interval is set. Incidents are reported within six hours; logs are kept for 180 days
    Who may test
    Not specified
    Empanelment mandatory?
    No

  • SOC 2, ISO/IEC 27001:2022, DPDP Act 2023

    Trust Services Criteria; Annex A; section 8(5) reasonable security safeguards

    Cadence
    Risk-based. Auditors expect annual testing, and testing after major change
    Who may test
    Any competent, independent tester whose evidence the auditor accepts
    Empanelment mandatory?
    No

  • Government and PSU tenders; NCIIPC-identified critical infrastructure

    Tender-specific

    Cadence
    Tender-specific
    Who may test
    Usually a CERT-In empanelled auditor, named in the tender
    Empanelment mandatory?
    Usually yes. Read the tender

In the SEBI row, or where a tender names the panel, only an empanelled organisation can sign. Everyone else may choose on quality, and should. The cadence each instrument sets is in how often VAPT must be done.

Empanelment

What CERT-In empanelment is, and what it is not

CERT-In, under MeitY, maintains a panel of information security auditing organisations. Firms join after a skills assessment, and the Ministry of Home Affairs vets their credentials. Empanelment is granted to the organisation, not to individual testers. It runs for a fixed cycle and must be renewed.

  • It tells you

    The firm passed CERT-In's capability assessment and Ministry of Home Affairs vetting when it was empanelled

    It does not tell you

    Which tester will work on your scope, or what that person holds

  • It tells you

    The report is acceptable where SEBI, IRDAI or a tender requires an empanelled signature

    It does not tell you

    Whether the test was manual, how deep it went, or how severity was decided

  • It tells you

    The entity name is checkable on CERT-In's current list, and the firm can state its empanelment block and renewal date

    It does not tell you

    Whether a retest is included, how fast a critical finding reaches you, or whether the price was fixed after scoping

Three checks. Verify the entity name on the live list, not a logo bar, because empanelment lapses and an old slide proves nothing. Ask whether the empanelled entity is the one signing your report, or a sister company. Then ask the same nine questions you would ask any firm, because the panel is a floor, not a method. Many regulated entities use both: a specialist firm tests early and proves which findings are real, and the empanelled auditor then runs the formal cycle against systems that already hold. See VAPT for banks, NBFCs and fintechs.

The checks

Nine criteria, with the source behind each

  • 1. Regulatory eligibility

    What to ask for
    If empanelment is mandatory for you, the firm's entity name on the current CERT-In list, plus its empanelment block and renewal date in writing
    Source
    CERT-In panel; SEBI CSCRF; IRDAI 2026 guidelines

  • 2. Manual, exploit-driven method

    What to ask for
    The written methodology, naming OWASP WSTG, ASVS, API Security Top 10, MASVS, PTES and NIST SP 800-115 by section
    Source
    PCI DSS 11.4.1: a documented methodology based on industry-accepted approaches

  • 3. Named, qualified, independent testers

    What to ask for
    Who will test, what they hold, and confirmation they did not build or operate the system
    Source
    PCI DSS 11.4.2 and 11.4.3: a qualified tester with organisational independence; PCI SSC Penetration Testing Guidance

  • 4. Severity you can defend

    What to ask for
    A CVSS v4.0 vector for each finding plus a business-impact rating
    Source
    FIRST CVSS v4.0 specification

  • 5. A report you can reproduce

    What to ask for
    A redacted sample with proof of concept, reproduction steps, affected asset, fix and executive summary
    Source
    PCI SSC guidance on report content; SEBI CSCRF summary-format submission

  • 6. Retest inside the price

    What to ask for
    Retest terms in the quote, the window, and a verified retest report
    Source
    PCI DSS 11.4.4: corrected and retested; SEBI CSCRF closure within three months, revalidation within five

  • 7. Critical-finding notice during the test

    What to ask for
    A written time-to-notify for critical findings
    Source
    No regulator sets one. SecureRoot's is three hours

  • 8. Fixed price after scoping

    What to ask for
    One number for the agreed scope, effort in tester-days, exclusions in writing
    Source
    See our guide to penetration testing cost in India

  • 9. The firm's own security

    What to ask for
    A certificate number you can check on the certification body's register, an NDA, and where your data sits during the test
    Source
    ISO/IEC 27001:2022

The field

How the five provider types compare

  • CERT-In empanelled auditing organisation

    Best for
    SEBI, IRDAI and tender-bound buyers
    Strength
    The signature is accepted where it is mandated, and the entity has been vetted
    Weakness
    Panel status says nothing about depth, and busy audit calendars can push your test to a junior bench

  • Large consultancy

    Best for
    Enterprises buying testing inside a wider programme
    Strength
    Bench size, many cities, procurement-ready paperwork
    Weakness
    Day rates, layered delivery, and testers who are not the people you met

  • Specialist testing firm (SecureRoot sits here)

    Best for
    Teams that want depth, fix support and a retest
    Strength
    Senior testers on the keyboard, proof per finding, fixed price, retest included
    Weakness
    Usually not empanelled; a smaller bench; fewer offices; may not scale to hundreds of assets at once

  • Automated scanning or PTaaS platform

    Best for
    Continuous coverage between manual tests
    Strength
    Fast, repeatable and cheap per asset
    Weakness
    Not a penetration test on its own. False positives, and no exploitation chain

  • Individual tester

    Best for
    Small scopes with a person you already trust
    Strength
    Low cost and direct access
    Weakness
    No organisational independence, no ISMS, and no continuity for the retest

  • In-house team

    Best for
    Mature application security functions
    Strength
    Context and speed
    Weakness
    Fails the independence test in PCI DSS 11.4 and with most auditors

Why this page does not rank named vendors

Every list on the first page for this query is published by a vendor that appears on it. We will not publish a ranking we cannot verify, and another firm’s method, bench and retest terms cannot be verified from its website. So this page gives you the checks, a scorecard you run yourself, and a plain statement of where we score badly.

Us, plainly

Where SecureRoot fits, and where it does not

Where we fall short

  • Not CERT-In empanelled. We cannot sign a SEBI CSCRF audit or VAPT, an IRDAI external test, or a tender that names the panel. We test earlier, beside that auditor.
  • Not a CPA firm and not an accredited ISO certification body. SOC 2 reports come from a partner CPA firm; ISO 27001 certificates come from the certification body.
  • No named client references in public. Our case studies are anonymised under NDAs that outlast the engagement. Ask for an anonymised deliverable walkthrough on a scoping call.
  • Two offices, both in Uttar Pradesh: Kanpur and Greater Noida West. Elsewhere we deliver remotely and quote on-site days where they are needed.
  • A small firm. A programme of dozens of assets is scoped separately and may suit a larger bench.
  • No firm-level CREST or similar accreditation. Credentials sit with the people who scope and sign: CISM, eWPTX, CEH and ISO 27001 Lead Auditor.

Where we are strong

  • Manual, exploit-driven testing with a proof of concept for every finding. Measured against OWASP WSTG, ASVS, API Security Top 10, MASVS, PTES, NIST SP 800-115 and OSSTMM, and graded with CVSS v4.0.
  • Critical findings reach you within three hours of discovery, not at the end of the engagement.
  • The retest sits inside the engagement, with a verified retest report and an attestation letter.
  • The price is fixed after scoping, never before.
  • Our own information security management system is certified: ISO/IEC 27001:2022, certificate IN60432E.

Who should not hire us: A SEBI or IRDAI entity that needs one firm to test and sign. A buyer who needs fifty testers on site in Mumbai next week. Anyone who wants a certificate without a test.

On the first call

Ten questions to ask

Write the scope with the types of penetration testing guide. For API-heavy products, see API security testing.

  1. 1Which named testers will be on our scope, and what do they hold?
  2. 2Show us a redacted report. Does every finding carry reproduction steps and a proof of concept?
  3. 3Is the retest in the price? What is the window, and do we get a verified retest report?
  4. 4How quickly do you tell us about a critical finding during the test?
  5. 5What is excluded from the fixed price, and what triggers a change?
  6. 6Which standards, and which sections of them, is the test measured against?
  7. 7If empanelment is mandatory for us: which entity is on the live CERT-In list, and until when?
  8. 8Where will our credentials, data and findings sit, and under what certificate?
  9. 9Who do we talk to when our developers disagree with a finding?
  10. 10Can we speak to a past client with their consent, or walk through an anonymised deliverable?

Walk away

Red flags that end the conversation

  • A price before scoping, or a day rate with no cap.
  • A “VAPT certificate” offered before testing starts.
  • A sample report that is a scanner export with a logo on it.
  • “Our tools are proprietary” as the answer to the methodology question.
  • An empanelment logo with no entity name, empanelment block or renewal date.
  • No retest at any price.

Run it yourself

A one-week evaluation you can run yourself

  1. Day one: find your regulator row above and gate out the provider types you may not use.
  2. Day two: send one written scope to three firms and ask the ten questions.
  3. Day three: score each firm with the table below.
  4. Day four: check certificate numbers and panel entries yourself.
  5. Day five: choose on score, not on price.
  • GateRegulatory eligibilityFail means out
  • 20Method and standardsNamed sections, with exploitation visible in the sample
  • 20Report qualityReproducible, ranked by impact, readable by the board
  • 15Retest and closureIncluded, documented, inside the regulator's window
  • 15TestersNamed, qualified, independent of the system
  • 10Price and termsFixed after scoping, exclusions in writing
  • 10The firm's own securityVerifiable certificate, NDA, data handling stated
  • 5Critical-finding noticeWritten hours, not “promptly”
  • 5ReferencesA consented reference, or an anonymised walkthrough

What you receive

What a SecureRoot VAPT hands you

A lending platform three months from a regulator-mandated audit, with no assessment on record: web and API testing, secure code review of the payment flows, fix sprints and verified retests, inside the audit window. 27 findings fixed, 100% of criticals closed, mean time to fix 9 days. Read it in case studies.

“The report was the first one our board actually read.”
Head of Engineering, fintech platform, Mumbai
  • A findings report with a proof of concept for every issue, ranked by business impact and graded with CVSS v4.0
  • An executive summary written for the board and the auditor
  • Remediation guidance, with engineer-to-engineer fix support
  • A verified retest report that records each finding as closed or still open, with the reason
  • An attestation letter for customer questionnaires and audit evidence
Request an assessment+91-7307148874

What it costs

The indicative band, and what sits outside it

Web, mobile, API or network testing, per surface: ₹50,000 to ₹4 lakh, retest included ($500 to $4,200). That covers a proof of concept per finding, a report with fixes, and one retest.; US dollar range as of 2 October 2026. These are ranges, not quotes.

  • The price is fixed after scoping, never before.
  • The retest is part of the engagement, not a separate invoice.
  • Third-party fees are quoted by the third party, not by us: the empanelled auditor’s formal audit, the CPA firm’s SOC 2 report, the certification body’s ISO audit, the ASV’s scans.

Finer bands by engagement type are in penetration testing cost in India, and every published band across the firm is on the pricing page.

Questions

What buyers ask before they shortlist

  • Is a CERT-In empanelled auditor mandatory for VAPT in India?

    Only where your regulator or a tender says so. SEBI's CSCRF requires audits and VAPT by a CERT-In empanelled information security auditing organisation unless the framework states otherwise, and even self-certification entities obtain their VAPT from an empanelled auditor. IRDAI's 2026 guidelines mandate periodic vulnerability assessments, penetration testing and audits; read the circular for the empanelled-auditor clause. Most government tenders write the panel in. RBI's 2026 Directions for banks, small finance banks and NBFCs ask for independent information security experts or auditors, and do not name the panel. PCI DSS asks for a qualified, organisationally independent tester, and an Approved Scanning Vendor for quarterly external scans. SOC 2, ISO 27001 and the DPDP Act set no empanelment condition. Read the clause that binds you, confirm the firm's entry on the live CERT-In list, then judge it on method, report and retest like any other firm.

  • How much does VAPT cost in India, and why do quotes vary so much?

    Our VAPT page publishes an indicative range per surface, with the retest included. A small web application sits near the bottom. A combined web and API assessment, or a multi-segment network test, sits higher. Quotes vary for four reasons. Scope: the number of roles, endpoints, hosts and platforms, not page count. Method: manual exploitation costs tester-days, and a scanner export does not. Inclusions: a retest, fix support and an attestation letter are inside some prices and extra in others. Timing: a test squeezed into an audit window costs more than one planned a quarter ahead. A quote before scoping is a guess, and a day rate with no cap is a blank cheque. Ask every firm for a fixed price against the same written scope, with exclusions listed.

  • Can we use a non-empanelled firm for testing and an empanelled auditor to sign?

    Yes, and for SEBI and IRDAI entities it is a common pattern. The empanelled organisation runs the formal cycle and signs the report your regulator receives. A specialist firm tests the same systems earlier and by hand. It proves which findings are real, helps your engineers close them, and retests. The auditor then confirms controls that already hold instead of opening a long remediation list. Two rules keep it clean. Keep the two engagements separate in writing, so the auditor's independence is never questioned. And align the timing: CSCRF expects the VAPT report within one month, closure within three and revalidation within five, so the pre-audit test should land a quarter before the formal cycle. SecureRoot is not CERT-In empanelled and works on the pre-audit side. We will say plainly on the scoping call if your requirement needs the empanelled firm alone.

  • What certifications should VAPT testers hold?

    Ask about people before logos. PCI SSC's Penetration Testing Guidance says to judge a tester on experience and certifications together. It endorses no certification, and that is the right standard for any buyer. Individual credentials you will see include OSCP, eWPTX, GPEN, GWAPT, CEH and CISM. CREST is a scheme for firms and individuals that UK and Australian buyers ask for more often than Indian ones. No Indian regulator requires any of them, and none proves a method. What matters is that the named tester on your scope has exploited systems like yours and can show a redacted report. That tester must also be independent of the system under test, as PCI DSS Requirement 11.4 asks. At SecureRoot, the people who scope and sign off hold CISM, eWPTX, CEH and ISO 27001 Lead Auditor. We do not claim firm-level CREST or OSCP.

  • How do we verify a VAPT company's claims before we sign?

    Check four things yourself, in about an hour. First, certificates: an ISO 27001 claim comes with a certificate number and a certification body, and the body's register confirms it is current. Ours is IN60432E. Second, empanelment: if it is mandatory for you, find the entity name on the current CERT-In list, not a slide, and ask for its empanelment block and renewal date in writing. Third, the report: a redacted sample shows whether findings carry reproduction steps and proof, or are scanner output with a logo. Fourth, the people: ask for the names and credentials of the testers on your scope, and whether they built or operate anything in it. Then read the quote for a fixed price, the retest window and the exclusions. Anything a firm cannot show in writing, treat as not offered. Published rankings are not verification, including this page.

  • Is SecureRoot CERT-In empanelled, and what does that mean for us?

    No. SecureRoot Risk Advisory LLP is not a CERT-In empanelled auditing organisation, and we will not blur that line. If your regulator or a tender requires the formal VAPT report to be signed by an empanelled auditor, that auditor signs it. This applies to SEBI CSCRF audits and VAPT, IRDAI external testing and most government tenders. For everyone else, including PCI DSS, SOC 2, ISO 27001 and DPDP Act programmes, empanelment is not a condition, and our reports are used as audit evidence there. What we are is a specialist testing firm whose own management system holds ISO/IEC 27001:2022 certificate IN60432E. We deliver manual, exploit-driven tests: a proof of concept per finding, critical findings within three hours, and a retest inside the price. We are also not a CPA firm and not an ISO certification body.

Send us the scope you would send the other three firms

You get a written scope, a timeline and a fixed price back, and a plain answer on whether you need an empanelled auditor instead.

Request an assessment Book a scoping call