A scanner tells you what is misconfigured. A person tells you what an attacker can actually do with it. Our VAPT engagements combine both, and end with a report your IT person can act on the same week.
We work with Pune and PCMC businesses that hold data worth stealing but do not have a security team of their own.
How we test
We follow a structure aligned to OWASP and PTES, so the work is repeatable and you can hand our report to an auditor without translation.
- 1. ScopingWe agree what is in and out: IP ranges, applications, testing windows, and what must never be touched (a production billing server at month-end, for example). This is written down and signed off before we send a single packet.
- 2. ReconnaissanceWe map what an outsider can find: exposed services, forgotten subdomains, leaked credentials, staff email formats.
- 3. ScanningAutomated tools sweep the scoped assets for known weaknesses. This is the fast, broad pass.
- 4. Manual exploitationThis is the part a scanner cannot do. We verify each finding, chain smaller weaknesses together, and test business logic: can a user see another customer's invoice by changing a number in the URL? Findings we cannot exploit are still reported, but marked as unproven.
- 5. ReportingEach finding gets a plain-language description, evidence, a risk rating, and a specific fix. Not "apply patches", but which patch, on which machine.
- 6. RetestOnce you have fixed the issues, we test them again and confirm which are closed.
Step-by-Step Timeline
- 1. Discovery call. Understand your systems and why you want testing. About 30 to 45 minutes.
- 2. Scope and written authorisation. Agree targets, windows, rules of engagement. Typically a few days.
- 3. Testing. Recon, scanning, manual exploitation. Typically a few days to two weeks, depending on scope.
- 4. Report and walkthrough. Findings delivered, explained live to your team. Typically a few days after testing.
- 5. Fix window. Your team remediates. Set by you.
- 6. Retest. Verify fixes, issue closure note. Typically a few days.
What You Receive
- ✓An executive summary a director can read in five minutes
- ✓A technical findings report with evidence, risk rating and fix steps for each issue
- ✓A prioritised remediation list, so you know what to fix first
- ✓A live walkthrough with your IT team or vendor
- ✓A retest report showing which findings are closed
- ✓A scope and authorisation record for your audit file
Who Is This For
- →SMEs and MSMEs in Pune and PCMC that keep client, billing or payroll data on a mix of office servers, cloud tools and a public website
- →Manufacturers with ERP, vendor portals, and a shop-floor network that was never designed with security in mind
- →Co-operative banks and credit societies that need periodic testing of internet-facing systems and internal networks to satisfy auditors
- →Hospitals and clinics running patient management software, billing systems and connected devices
- →Any business after an incident, or one about to onboard an enterprise client who has sent a security questionnaire
What We Don't Do
We do not promise "100% secure". Testing shows what we found in the agreed scope and time window, not everything that could ever be wrong. We do not test systems you do not own or have not authorised in writing, and we do not run denial-of-service tests on production systems unless you explicitly ask and we agree a window.
Related
- Most real-world intrusions start with a person clicking something. If your report shows phishing exposure, our staff cybersecurity training is the natural follow-up, delivered by the same people who ran your test. Staff cybersecurity training →
Frequently Asked Questions
What is the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment lists weaknesses, mostly found by tools. A penetration test goes further: someone tries to exploit those weaknesses to show what an attacker could actually reach. Our VAPT service does both.
How long does a VAPT take?
Testing typically takes a few days to two weeks, depending on how many systems and applications are in scope. Add a few days for the report and a walkthrough. We give you a firm timeline after scoping, not before.
Will testing disrupt our operations?
We agree testing windows in advance and avoid your busy periods. Anything risky to production is discussed with you first, and you have a contact who can tell us to stop.
Do you test web applications, networks, or both?
Both. Scope can include external networks, internal networks, web applications, mobile apps and Wi-Fi. We decide the mix with you during scoping.
Do we get a certificate?
You get a formal report and retest note that you can show to auditors and clients. We do not issue a "certified secure" badge, because no honest tester can.
Will you fix the issues too?
We tell you exactly how to fix each one and verify the fix in retest. If you want us to help your IT team implement changes, we discuss that separately.
Do you help with CERT-In or ISO 27001 requirements?
VAPT evidence is often requested for both. We can tell you what our report covers and where you will need other documentation. See our ISO 27001 readiness service for the fuller path.
Where are you based?
Pune. We work with businesses across Pune and PCMC, in person or remotely depending on scope.
Ready to Get Started?
Tell us about your requirements and we'll respond with a tailored proposal within 24 hours.
