VAPT · Penetration Testing
Find Vulnerabilities
Before Attackers Do
TCSA delivers manual-first vulnerability assessment and penetration testing (VAPT) for web applications, mobile apps, APIs, networks, and cloud environments across India. Our specialty is compliance-driven testing for SOC 2, ISO 27001, HIPAA, and RBI audits.
Indicative pricing starts at ₹40,000 for a typical SaaS web application (up to ₹1.5 lakh for larger scopes) — full scope-wise bands are in the pricing table below. Where regulators require it, we deliver CERT-In empanelled reports with CERT-In empanelled partners. The testing practice is led by Parth Chauhan (CEH, BE BITS Pilani).
Delivered with CERT-In empanelled partners · OWASP WSTG / MASVS aligned · Last reviewed June 2026
Testing Services
Security Testing Across All Attack Surfaces
Comprehensive security testing across all attack surfaces — every engagement combines automated scanning with deep manual penetration testing.
Web Application VAPT
OWASP Top 10 & Beyond
Comprehensive testing of web applications including SQL injection, XSS, CSRF, authentication bypass, session management flaws, and business logic vulnerabilities. Covers both client-side and server-side security.
Testing Scope
- Authentication & Authorization
- Input Validation
- Session Management
- API Security
- Business Logic Flaws
Mobile App VAPT
iOS & Android Security
Deep security analysis of mobile applications including reverse engineering, insecure data storage, weak cryptography, insecure communication, and platform-specific vulnerabilities. OWASP MASVS compliant testing.
Testing Scope
- Binary Analysis
- Data Storage Security
- Network Communication
- Code Obfuscation
- Runtime Manipulation
Network VAPT
Infrastructure Penetration
External and internal network penetration testing including firewall bypass, router exploitation, switch attacks, VPN security, wireless security, and network segmentation testing. Identifies misconfigurations and vulnerabilities.
Testing Scope
- Perimeter Security
- Internal Network
- Wireless Networks
- VPN Assessment
- Network Segmentation
Cloud Security VAPT
AWS, Azure, GCP Testing
Cloud infrastructure security assessment including IAM misconfigurations, storage bucket exposure, serverless vulnerabilities, container security, and cloud-native service exploitation. Multi-cloud expertise.
Testing Scope
- IAM & Access Control
- Storage Security
- Container Security
- Serverless Functions
- Cloud Configurations
API Security Testing
REST, GraphQL, SOAP
Specialized API security testing covering authentication flaws, authorization bypass, rate limiting issues, injection attacks, data exposure, and API-specific vulnerabilities. OWASP API Security Top 10 focused.
Testing Scope
- Authentication Mechanisms
- Authorization Logic
- Rate Limiting
- Data Validation
- API Versioning
Database VAPT
SQL, NoSQL, Data Security
Database security assessment including privilege escalation, SQL injection, NoSQL injection, weak authentication, encryption analysis, and data leakage. Covers MySQL, PostgreSQL, MongoDB, Redis, and more.
Testing Scope
- Access Controls
- Injection Attacks
- Encryption at Rest
- Backup Security
- Audit Logging
Wireless VAPT
WiFi, Bluetooth, IoT
Wireless network security testing including WPA/WPA2/WPA3 cracking, rogue access point detection, evil twin attacks, Bluetooth vulnerabilities, and IoT device security assessment.
Testing Scope
- WiFi Security
- Bluetooth Analysis
- IoT Devices
- Rogue AP Detection
- Wireless Protocols
Thick Client VAPT
Desktop Application Security
Security testing of desktop applications including reverse engineering, memory analysis, local data storage, insecure communication, DLL hijacking, and privilege escalation vulnerabilities.
Testing Scope
- Binary Analysis
- Memory Inspection
- Local Storage
- Communication Security
- Privilege Escalation
Indicative Pricing
Scope-Wise Pricing Bands
Scope-wise indicative bands — the final quote depends on size and depth of testing.
| Testing Scope | Indicative Price (INR) | Notes |
|---|---|---|
| Web Application VAPT | ₹40,000 – ₹1.5 Lakh | Typical SaaS scope; OWASP WSTG grey-box |
| Mobile App VAPT (iOS / Android) | ₹50,000 – ₹1.5 Lakh | Per platform; OWASP MASVS aligned |
| API Security Testing | ₹40,000 – ₹1.2 Lakh | REST / GraphQL; OWASP API Top 10 |
| External Network VAPT | ₹30,000 – ₹1 Lakh | Internet-facing IPs and services |
| Internal Network VAPT | ₹60,000 – ₹2 Lakh | AD, segmentation, lateral movement |
| Cloud Configuration Review | ₹50,000 – ₹1.5 Lakh | AWS / Azure / GCP misconfiguration review |
All prices indicative, GST extra; exact quotes follow a short scoping call. Full bands and cost drivers: VAPT cost in India (2026).
Our Methodology
Testing Methodology
A five-phase methodology that moves from reconnaissance to a prioritised remediation roadmap.
Reconnaissance
Information gathering & attack surface mapping
Scanning
Automated vulnerability detection & enumeration
Exploitation
Manual penetration & privilege escalation
Post-Exploit
Data exfiltration simulation & persistence
Reporting
Detailed findings with remediation roadmap
“Great VAPT service with a highly professional and knowledgeable team and strong focus on manual testing. The team went beyond automated scans to uncover deeper, real-world vulnerabilities that tools often miss.”
VAPT — Frequently Asked Questions
Cost, timelines, CERT-In requirements, retests, and what the report contains.
How much does VAPT cost in India?
Indicative pricing by scope: web application VAPT ₹40,000–₹1.5 lakh for a typical SaaS scope, mobile app ₹50,000–₹1.5 lakh per platform, API testing ₹40,000–₹1.2 lakh, external network ₹30,000–₹1 lakh, internal network ₹60,000–₹2 lakh, and cloud configuration review ₹50,000–₹1.5 lakh. The final quote depends on scope size (pages, endpoints, IPs, user roles) and testing depth. See our VAPT cost guide for India (2026) for detailed bands and what drives them.
How long does a VAPT engagement take?
A typical web application or API engagement takes 5–10 working days of testing plus 2–3 days for reporting. Mobile and internal network engagements usually run 2–3 weeks. Add about a week for the retest after your team ships fixes. If you are working against a SOC 2, ISO 27001, or RBI submission deadline, tell us — compliance-driven timelines can be fast-tracked.
What is the difference between VAPT and an automated vulnerability scan?
An automated scan only flags known signatures and misconfigurations — it cannot test business logic, chain low-severity findings into a real compromise, or bypass authentication the way a human attacker does. VAPT combines automated scanning with manual penetration testing: exploiting vulnerabilities, escalating privileges, and proving real-world impact with evidence. Auditors, enterprise customers, and regulators generally accept manual VAPT reports, not raw scanner exports.
When is a CERT-In empanelled VAPT report required?
RBI-regulated entities — banks, NBFCs, payment aggregators and payment gateways — and organisations responding to certain government, SEBI, or IRDAI mandates must submit security audit reports issued by a CERT-In empanelled organisation. For these engagements TCSA delivers the testing with CERT-In empanelled partners: one team manages scoping, testing, and remediation support, and the empanelled partner issues the report your regulator accepts.
Is a retest included after we fix the findings?
Yes. Every TCSA VAPT engagement includes a retest round to verify your fixes, typically scheduled within 30–45 days of the final report. Verified findings are marked as remediated in an updated report, and you receive a closure summary you can share with auditors and enterprise customers.
What does the VAPT report contain?
An executive summary with overall risk posture, detailed technical findings with CVSS v3.1 severity ratings, step-by-step proof-of-concept evidence (requests, payloads, screenshots), business impact analysis, and prioritised remediation guidance mapped to OWASP and compliance frameworks such as SOC 2, ISO 27001 (A.8.8), and RBI requirements. After the retest you also receive an updated fix-verification report.
Keep Exploring
Related Reading
ISO 27001 Overview
The ISMS standard — the baseline certificate global buyers ask for.
Read moreSOC 2 Overview
The AICPA attestation US and global enterprise buyers ask for.
Read moreOperational Resilience Consulting
One ISO 22301-grade BCMS that answers CBUAE, SAMA, CPS 230 and DORA.
Read morevCISO / vDPO
A named, certified security and privacy leader — fractional.
Read moreProof & Track Record
Every number we publish — explained, sourced and verifiable.
Read moreCase Studies
Anonymized engagements across fintech, SaaS, healthcare and AI.
Read moreWritten By Expert Auditors
Get in touch
Book a free consultation or send us your requirements. We respond within 24 hours.
Quick Call
Pick a time slot
Send Requirements
Get a custom quote in 24 hours