TCSA delivers manual-first vulnerability assessment and penetration testing (VAPT) for web applications, mobile apps, APIs, networks, and cloud environments across India. Our specialty is compliance-driven testing for SOC 2, ISO 27001, HIPAA, and RBI audits.
Indicative pricing starts at ₹40,000 for a typical SaaS web application (up to ₹1.5 lakh for larger scopes) — full scope-wise bands are in the pricing table below. The testing practice is led by Parth Chauhan (CEH, BE BITS Pilani). We deliver CERT-In audits, end to end, with our CERT-In empanelled partners.
CERT-In audits delivered end to end with our CERT-In empanelled partners · OWASP WSTG / MASVS aligned · Last reviewed June 2026
We deliver CERT-In audits
We deliver CERT-In audits, end to end, with our CERT-In empanelled partners. That includes safe-to-host audits for government websites and apps, and the security audits regulators ask of banks, NBFCs, payment companies and insurers.
Key Takeaways
- Manual-first VAPT across web, mobile, API, network, and cloud — we go beyond automated scans to find business-logic flaws and chained exploits that tools miss.
- Indicative pricing: web application VAPT runs ₹40,000–₹1.5 lakh for a typical SaaS scope. See the scope-wise pricing table below for all bands.
- Compliance-driven testing is our specialty — reports mapped to SOC 2, ISO 27001, HIPAA, and RBI expectations, with a retest included to verify fixes.
- Need a CERT-In audit for an RBI-regulated entity or a government mandate? We deliver CERT-In audits, end to end, with our CERT-In empanelled partners.
- The testing practice is led by Parth Chauhan (CEH, ISO 27001/27701/42001 Lead Auditor, BE BITS Pilani).
Security Testing Across All Attack Surfaces
Comprehensive security testing across all attack surfaces — every engagement combines automated scanning with deep manual penetration testing.
Web Application VAPT
Comprehensive testing of web applications including SQL injection, XSS, CSRF, authentication bypass, session management flaws, and business logic vulnerabilities. Covers both client-side and server-side security.
- Authentication & Authorization
- Input Validation
- Session Management
- API Security
- Business Logic Flaws
Mobile App VAPT
Deep security analysis of mobile applications including reverse engineering, insecure data storage, weak cryptography, insecure communication, and platform-specific vulnerabilities. OWASP MASVS compliant testing.
- Binary Analysis
- Data Storage Security
- Network Communication
- Code Obfuscation
- Runtime Manipulation
Network VAPT
External and internal network penetration testing including firewall bypass, router exploitation, switch attacks, VPN security, wireless security, and network segmentation testing. Identifies misconfigurations and vulnerabilities.
- Perimeter Security
- Internal Network
- Wireless Networks
- VPN Assessment
- Network Segmentation
Cloud Security VAPT
Cloud infrastructure security assessment including IAM misconfigurations, storage bucket exposure, serverless vulnerabilities, container security, and cloud-native service exploitation. Multi-cloud expertise.
- IAM & Access Control
- Storage Security
- Container Security
- Serverless Functions
- Cloud Configurations
API Security Testing
Specialized API security testing covering authentication flaws, authorization bypass, rate limiting issues, injection attacks, data exposure, and API-specific vulnerabilities. OWASP API Security Top 10 focused.
- Authentication Mechanisms
- Authorization Logic
- Rate Limiting
- Data Validation
- API Versioning
Database VAPT
Database security assessment including privilege escalation, SQL injection, NoSQL injection, weak authentication, encryption analysis, and data leakage. Covers MySQL, PostgreSQL, MongoDB, Redis, and more.
- Access Controls
- Injection Attacks
- Encryption at Rest
- Backup Security
- Audit Logging
Wireless VAPT
Wireless network security testing including WPA/WPA2/WPA3 cracking, rogue access point detection, evil twin attacks, Bluetooth vulnerabilities, and IoT device security assessment.
- WiFi Security
- Bluetooth Analysis
- IoT Devices
- Rogue AP Detection
- Wireless Protocols
Thick Client VAPT
Security testing of desktop applications including reverse engineering, memory analysis, local data storage, insecure communication, DLL hijacking, and privilege escalation vulnerabilities.
- Binary Analysis
- Memory Inspection
- Local Storage
- Communication Security
- Privilege Escalation
Scope-Wise Pricing Bands
Scope-wise indicative bands — the final quote depends on size and depth of testing.
| Testing Scope | Indicative Price (INR) | Notes |
|---|---|---|
| Web Application VAPT | ₹40,000 – ₹1.5 Lakh | Typical SaaS scope, OWASP WSTG grey-box |
| Mobile App VAPT (iOS / Android) | ₹50,000 – ₹1.5 Lakh | Per platform, OWASP MASVS aligned |
| API Security Testing | ₹40,000 – ₹1.2 Lakh | REST / GraphQL, OWASP API Top 10 |
| External Network VAPT | ₹30,000 – ₹1 Lakh | Internet-facing IPs and services |
| Internal Network VAPT | ₹60,000 – ₹2 Lakh | AD, segmentation, lateral movement |
| Cloud Configuration Review | ₹50,000 – ₹1.5 Lakh | AWS / Azure / GCP misconfiguration review |
All prices indicative, GST extra. Exact quotes follow a short scoping call. Full bands and cost drivers: VAPT cost in India (2026).
Testing Methodology
A five-phase methodology that moves from reconnaissance to a prioritised remediation roadmap.
Reconnaissance
Information gathering & attack surface mapping
Scanning
Automated vulnerability detection & enumeration
Exploitation
Manual penetration & privilege escalation
Post-Exploit
Data exfiltration simulation & persistence
Reporting
Detailed findings with remediation roadmap
What Clients Say
Our SOC 1 and SOC 2 journey couldn't have been made more simple. TCSA guided us throughout and helped us unblock our enterprise deal.
CISOMurliCompanyForsys Inc.Client testimonial
“Great VAPT service with a highly professional and knowledgeable team and strong focus on manual testing. The team went beyond automated scans to uncover deeper, real-world vulnerabilities that tools often miss.”
VAPT — Frequently Asked Questions
Cost, timelines, CERT-In requirements, retests, and what the report contains.
How much does VAPT cost in India?
How long does a VAPT engagement take?
What is the difference between VAPT and an automated vulnerability scan?
When is a CERT-In empanelled VAPT report required?
Is a retest included after we fix the findings?
What does the VAPT report contain?
Related Reading
ISO 27001 Overview
The ISMS standard — the baseline certificate global buyers ask for.
Read moreSOC 2 Overview
The AICPA attestation US and global enterprise buyers ask for.
Read moreOperational Resilience Consulting
One ISO 22301-grade BCMS that answers CBUAE, SAMA, CPS 230 and DORA.
Read morevCISO / vDPO
A named, certified security and privacy leader — fractional.
Read moreProof & Track Record
Every number we publish — explained, sourced and verifiable.
Read moreCase Studies
Client stories from AI, healthtech and air cargo teams, and representative engagements by sector.
Read more