VAPT Services

Seven surfaces: web applications, mobile applications on Android and iOS, APIs, thick clients, network infrastructure (external and internal), IoT and embedded devices, and cloud accounts on AWS, Azure, GCP, DigitalOcean and Oracle Cloud. Each is a separate service with its own scope, methodology and pricing band, and you can combine them in one engagement, for example a web application, the API behind it and the cloud account it runs in. The work is manual and exploit-driven: our engineers test by hand, the way an attacker would, and use tooling to widen coverage rather than to replace judgement. Every finding we report has been proven with a proof of concept, is explained in business language and ranked by the damage it does, and comes with clear remediation. A retest is part of the engagement, so you can show the fix held.

One scoping call, usually 30 to 45 minutes, with the people who will do the work. Bring the deadline, the auditor's question or the customer questionnaire that started this, and tell us what you run. We map the surfaces that matter against what is urgent, agree the targets, environments, roles and any off-limits actions, and then send you a written scope, a timeline and a fixed price. The price is fixed after scoping, never before, and it does not grow later as an open-ended estimate would. If we are not the right fit for the problem, we say so on the call. Once the scope is signed, we set testing windows and escalation contacts so nothing takes your team by surprise, and the engagement starts from an agreed Rules of Engagement.

Most web or API assessments run one to three weeks depending on scope, plus a retest window once your fixes are in. A single web application usually takes one to two weeks, driven by the number of roles, features and endpoints we test by hand; a mobile application depends on whether Android, iOS or both are in scope and how large the backend behind the app is; a network test depends on whether it is external, internal or both and how many hosts and segments it covers. We confirm the timeline once scoping is done. You do not wait for the report to hear bad news: critical findings reach you within three hours of discovery, so your team can start on the fix while the rest of the test continues.

Indicative range: ₹50,000 to ₹4 lakh, retest included, for a web application, mobile application, API or network penetration test. Where an engagement lands in that range depends on scope. For a web application it is mainly the number of roles, features and endpoints; for a mobile application, whether we test Android, iOS or both and the size of the backend; for an API, how many endpoints, tenants and authentication schemes we cover; for a network, whether the test is external, internal or both and how many hosts and segments it spans. These are ranges, not quotes. We confirm a fixed price once scoping is done, and that price includes the retest, so there is no separate invoice for verifying your fixes. The indicative ranges are reviewed and stated in INR on each service page.

Yes to both. Every finding carries specific remediation guidance, and the engineer who found the flaw is the one who explains the fix to your developer, in your language and your codebase. Our engineers are available to yours during fix sprints, and when you tell us the fixes are in, we retest each finding and confirm whether it is genuinely closed. The retest is part of the engagement, not a separate invoice, and it produces a verified retest report you can hand to an auditor or a customer. A closed finding means fixed and retested, not acknowledged. If a fix does not hold, the finding stays open and we tell you why, so the report you finally rely on reflects what an attacker would actually find today rather than what was promised.

That is a common reason clients come to us, and the deliverables are built for it. You receive a findings report with proof of concept for every issue, an executive summary, remediation guidance, a verified retest report and an attestation letter, so the evidence trail runs from discovery to confirmed closure. The same team scopes ISO 27001, SOC 2 and DPDP Act programmes and the manual VAPT engagements that test them, so the test can be timed to your audit window and scoped to the systems the auditor will ask about. SecureRoot itself holds ISO/IEC 27001:2022 certificate IN60432E. If you need the compliance side as well, the SOC 2, ISO 27001 and DPDP Act services linked below are run by the same people, from one control set and one evidence base.