How to choose a VAPT company in India
Choose a VAPT company by what it shows you before you sign: a written scope, manual testing, a sample report, named deliverables, retest terms, independent testers and clear confidentiality terms. Check first whether a regulator, tender or contract requires a CERT-In empanelled auditor, because that one condition can settle the shortlist before anything else does.
- Signs to check
- Eight, below
- Questions to ask
- Ten, with red flags
- CERT-In
- When it is required
- Prices
- In the cost guide
Last reviewed
- Scope in writing before the price is final
- Manual testing, with the tester-days stated
- A sample report shown before you sign
- Named deliverables and retest terms in the proposal
- Independent testers and clear confidentiality terms
Ten questions to ask any vendor, with what a good answer sounds like and the red flags.
01 / What to look for
What a good VAPT company shows you before you sign
A good VAPT company is easy to check, because it puts the important things in writing before any money changes hands. These eight signs make up a VAPT company checklist you can use with any firm, including us.
Scope in writing
Before testing starts, a good firm writes down what it will cover: the applications and the roles inside them, the API endpoints, the IP ranges, the environment, the testing window and anything off limits. That document is the yardstick for the price, and the final report should say plainly that it covered it.
Manual testing
Ask how the hours split between people and tools. Scanners are fast at known patterns, while broken access control, business-logic flaws and chains of small weaknesses are found by a tester working by hand. A good firm can say which parts of your scope get manual attention and roughly how many tester-days that takes.
A sample report
The report is what stays with you once testing ends. A redacted or illustrative sample shows whether each finding comes with reproduction steps, evidence, its impact and a fix your developers can apply, and whether management gets a summary it can read. Without one, you are buying blind.
Named deliverables
The proposal should list what you will receive, by name: a management summary, a technical report, how severity is scored, a fix for each finding and any closure document. A vague promise of a comprehensive report is hard to hold anyone to later.
Retest terms
Fixes need checking. Ask if a fix check comes with the price, how many rounds it covers, how long after the first report you may use it, and whether an updated report follows that your auditor or customer can see.
Tester independence
The people testing your systems should not be the people who built them, run them or sold you the products that protect them. Ask whether the firm develops, hosts or resells anything inside your scope, and how it keeps the test at arm's length if it does.
Confidentiality
A test hands over credentials, network access and, at the end, a document that explains how to break in. Look for a non-disclosure agreement before you share scoping details, an agreed way to pass credentials and reports, and a stated point at which your data is deleted.
Contact during testing
Agree who calls whom if testing turns up something critical or a system slows down. A careful firm names an emergency contact on its side, asks for one on yours, and agrees in advance which actions need your go-ahead on a live system.
02 / Questions to ask
Questions to ask a penetration testing vendor
The answers matter more than the sales deck. For each question, the table gives the kind of answer a firm that does careful work tends to give, and the answer that should make you look elsewhere.
| Question | A good answer sounds like | Red flag |
|---|---|---|
| What exactly will you test, and will that go into the proposal? | A list of assets, roles, environments and exclusions, sent to you for confirmation before the figure is final. | A price before anyone has asked what you run, or a scope described only as complete VAPT. |
| What share of the testing is manual? | A split of what is scanned and what is tested manually, with the tester-days behind each part. | A claim that a platform finds everything, or a sample that reads like scanner output with a logo on it. |
| Can we see a sample report before we sign? | A redacted or illustrative report, shared now, with reproduction steps, evidence and a fix for every finding. | A brochure in place of a report, or a sample offered only after the contract is signed. |
| Who will test our systems, and can we speak to them? | Named testers, the experience and certifications relevant to your systems, and a call with the lead tester while scoping. | Senior names in the pitch and no commitment about who will actually do the work. |
| How do you make sure a finding is real? | Every automated result is checked by a person, and each reported finding carries evidence such as a proof of concept. | Long lists of unverified results, or no answer at all about false positives. |
| What happens once we have fixed the findings? | Written retest terms: what is included, how many rounds, the time window, and whether an updated report follows. | Retests raised only after the first report arrives, or charged at a rate nobody mentioned. |
| How will you handle our credentials, data and report? | A non-disclosure agreement before details are shared, an agreed channel for credentials, and a stated deletion point. | Passwords requested over chat with nothing signed, or silence about what happens to your data afterwards. |
| Do you build, host or resell anything that is in our scope? | A plain yes or no and, if yes, how the testers are kept separate from that work. | An offer to test the application the same firm built, with no word on how that conflict is handled. |
| Will the report meet what our auditor or customer asked for? | A request to see that requirement in writing, a scope built from it, and no promise about the auditor's decision. | A promise of a clean audit result, or a certificate offered as proof that you meet a standard. |
| What if testing finds something critical, or a system slows down? | Emergency contacts named on both sides, an agreed way to pause testing, and a same-day call about a critical finding. | No named contact and no agreed point at which testing stops. |
Put the same questions to every firm on your shortlist, in writing, and compare the answers side by side. Specific answers are easy to give when the work behind them is real; vague ones are worth pressing on.
03 / CERT-In
When do you need a CERT-In empanelled firm?
CERT-In (the Indian Computer Emergency Response Team) keeps a published list of information security auditors that it has chosen. Some regulators, tenders and contracts require the audit to come from an organization on that list; for everyone else, the list is optional.
Show details for When do you need a CERT-In empanelled firm?
Whether a firm is empanelled decides which mandated audits it may take on. It does not, by itself, tell you how a particular test will be run. Organizations on the list have been selected by CERT-In and are bound by its audit guidelines; organizations off the list can do the same kinds of testing wherever no rule asks for the list.
| Who you are | What usually applies | What to check |
|---|---|---|
| A SEBI-regulated entity, such as a stock broker, depository or mutual fund | Under SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF), the audits and VAPT of these entities need a CERT-In empanelled auditor, unless SEBI has specified otherwise. | The current CSCRF circular and any later clarification that applies to your category. |
| A government department, a PSU, or a bidder on a GeM tender | Many tenders and hosting rules ask for a CERT-In empanelled auditor; some ask only for an independent security test. | The bidder-eligibility clause and the technical clauses of the tender document. |
| Another regulated business, such as a payment aggregator or an insurer | Their regulators' directions and guidelines are reported to call for audits by empanelled auditors. | The current text from your regulator, read with your compliance team. |
| A bank or a larger NBFC | The RBI's 2023 Master Direction on IT governance expects vulnerability assessments and penetration tests from testers who are trained and independent; the lender's own policy may go further and name empanelment. | Your board-approved policy and what your examiner has asked for. |
BERRY9 is not CERT-In empanelled. Should your regulator, a tender or a contract require an empanelled auditor, that work belongs to a firm CERT-In has listed, and we say so at the first call, before any payment.
04 / When it is not required
When an empanelled auditor is not required
Much of the testing that SaaS companies, startups and suppliers buy is driven by frameworks and customers that do not ask for CERT-In empanelment. For these, any competent independent firm can do the work.
Show details for When an empanelled auditor is not required
SOC 2
SOC 2 does not require a penetration test. Its criteria ask for controls that find and manage vulnerabilities, penetration testing is one common way to show that, and your auditor decides what evidence is enough. CERT-In empanelment is not part of the AICPA's criteria.
ISO 27001
ISO/IEC 27001:2022 asks for technical vulnerability management in Annex A, control 8.8. It does not say who must do the testing, and the certification body decides what evidence it accepts.
DPDP Act
The DPDP Act of 2023 obliges every data fiduciary to take reasonable security safeguards. It names neither penetration testing nor an empanelled auditor; a test is one way to check that the safeguards hold.
Customer questionnaires
Enterprise customers and investors running due diligence commonly ask for a recent report from an independent tester. Their contract or questionnaire decides what counts, so read its security clause before you pick a firm.
BERRY9 tests; it does not certify, audit or decide what an auditor accepts. For card payments, see PCI DSS penetration testing: PCI DSS 4.x calls for penetration testing in requirement 11.4, and that page explains which parts of the work need other specialists.
05 / Rankings
Is there a ranking of VAPT companies in India?
No official body ranks VAPT companies in India. Lists of top firms in search results are often published by firms that sell testing themselves, so use them as a source of names rather than as a verdict.
Show details for Is there a ranking of VAPT companies in India?
CERT-In's list
CERT-In publishes the auditing organizations it has selected. It matters when a regulator, tender or contract requires a firm from it, and it is a list of eligible auditors, not an order of merit.
Directories and review sites
Business directories and review sites show who is active and what past clients say. Read the reviews that describe testing work, and note how recent they are.
Your auditor and your peers
An auditor, a compliance consultant or a company of your size that went through the same audit can name firms whose reports served them well. Ask what went smoothly and what took chasing.
Your own comparison
The firm that suits you is the one whose scope, sample report and answers fit your systems and your deadline. Three firms asked the same questions in writing will tell you more than any list.
Where a firm sits matters less than it seems. Anything reachable over the internet, such as a web application, an API or an external network, can be tested from another city; internal networks are reached through agreed remote access, and work that needs someone on your premises, such as wireless testing, is arranged separately. BERRY9 works this way from Hyderabad: see VAPT services in Hyderabad and VAPT services across India.
06 / Price signals
What a VAPT price tells you, and what it does not
A VAPT price is mostly tester time. Read any figure as a number of days of skilled work and ask whether it fits the scope; the signals below are worth noticing before you compare totals.
Show details for What a VAPT price tells you, and what it does not
- A figure with no scope behind it. Before a firm knows your roles, endpoints and hosts, any number it gives is a guess, and it will move once the real scope appears.
- A small fee for a large scope. When a low figure covers several applications or a whole network, ask how many tester-days it buys. The gap is usually filled by automated scanning.
- A large fee with no breakdown. A high price is no proof of depth either. Ask which people, how many days and which deliverables it pays for.
- Different footings. Put every proposal on the same basis before comparing: before or after GST, with or without a check of your fixes, one environment or two.
- Bundles and yearly plans. A bundle of scopes or a yearly plan can lower the cost of each test, but read what each test inside it includes, and whether unused tests lapse.
For what moves a VAPT price, and the starting prices BERRY9 publishes, read the VAPT cost guide for India. This guide gives no other firm's prices on purpose: they depend on scopes that are not comparable.
07 / Shortlist
Building a shortlist in five steps
A short, written process keeps the comparison fair and gives every firm the same chance to answer well.
Show details for Building a shortlist in five steps
Step 1
Write down the requirement
Note who asked for the test, what their document calls it (VAPT, penetration test, security audit) and the date the report is due. If a document names CERT-In, settle that first.
Step 2
List what is in scope
Applications and their roles, APIs, IP ranges, cloud accounts, offices with wireless, and the environment to test. A rough list is enough to start; firms will help refine it.
Step 3
Ask three firms the same questions
Send the scope and the ten questions to each firm in writing, and ask for a sample report with the reply.
Step 4
Compare like with like
Line up the scopes, tester-days, deliverables, retest terms and dates. Drop any proposal that cannot say what it covers.
Step 5
Read the contract
Check the scope, the testing window, the rules of engagement, the confidentiality terms and the payment terms before anyone is given access.
OutputA signed scope and rules of engagement
08 / Our answers
How BERRY9 answers the checklist
Here is the same checklist answered for BERRY9, with links to the pages that show each answer. Where the owner has not yet confirmed a detail, the answer says so.
Show details for How BERRY9 answers the checklist
| What to check | BERRY9's answer |
|---|---|
| Scope in writing | Every engagement starts with a scoping conversation; the assets, rules of engagement, emergency contacts and hard stops are written down before testing begins. The VAPT methodology sets out each of the five phases. |
| Manual testing | Beyond the starter scope, tests are manual-led: scanners run alongside, and an engineer confirms each automated result before it can appear in the report. The starter scope combines a vulnerability scan with manual checks. |
| Sample report | The sample VAPT report sets out both reports, using an illustrative example instead of client data. |
| Named deliverables | Two reports: an executive report that management can read, and an engineering report in which every finding has its reproduction steps and a proof of concept. Severity is scored with CVSS 3.1, and a remediation matrix pairs every finding with its fix. |
| Retest terms | The starter scope is priced from INR 9,000 + 18% GST for small scopes such as 3 to 5 external IP addresses or a simple WordPress website, including a vulnerability scan, manual checks, a written report and one free retest. For every other test, how fixes are checked is set out in the written proposal. |
| Who tests | BERRY9 engineers, working from our one office in Hyderabad. |
| Independence | Ask us at scoping. |
| Confidentiality | BERRY9 itself holds ISO/IEC 27001:2022 certificate 26MEQVU27; that certificate is ours and does not certify your organization. A non-disclosure agreement is available on request. How credentials and reports are exchanged, and when client data is deleted, is agreed in writing before work starts. |
| What your auditor asked for | BERRY9 tests and reports, and your auditor decides what it accepts. Send the auditor's or customer's requirement first, and the scope is built from it. |
| CERT-In | If a rule in your case requires an empanelled auditor, BERRY9 is the wrong choice for that piece of work, and the scoping call is where we say so. |
| Price | Every other test starts from INR 27,000 + 18% GST; advanced scopes get a written proposal once scoping is done. See the VAPT cost guide for what pushes a figure up or down. |
| Schedule | A typical scope takes 5 to 10 working days from kickoff, and the proposal gives the dates. |
Tests BERRY9 runs
- Testing web applications
- Testing APIs
- Testing mobile apps
- Testing networks
- Reviewing cloud accounts
- Every test we run
Not sure which test you need, or how a vulnerability assessment differs from a penetration test? Read VAPT vs penetration testing, or send us your scope and we will suggest one.
09 / FAQ
Frequently asked questions
Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.
How do I choose a VAPT company in India?
Start from the requirement: who asked for the test and whether their document names CERT-In empanelment. Then give three firms the same scope and questions in writing, compare their sample reports, and choose the one that states its scope, manual effort, deliverables, retest terms and confidentiality terms most clearly. See the section on What a good VAPT company shows you before you sign above.
Is there an official ranking of VAPT companies in India?
No. No official body ranks VAPT companies in India. CERT-In publishes a list of the auditing organizations it has selected, which matters when a rule requires one of them, but that list is not an order of merit, and the top-ten lists in search results are often written by firms that sell testing. See the section on Is there a ranking of VAPT companies in India? above.
What is the difference between a CERT-In empanelled and a non-empanelled VAPT company?
Eligibility. When a regulator, tender or contract requires a CERT-In empanelled auditor, the audit has to come from CERT-In's list. Where no such rule applies, a firm off the list can run the same kinds of test, and the scope, the testers and the report decide its value. See the section on When do you need a CERT-In empanelled firm? above.
Does SOC 2 or ISO 27001 call for a CERT-In empanelled auditor?
Not for the frameworks themselves. A SOC 2 auditor decides what evidence is enough, and ISO/IEC 27001 expects technical vulnerability management but does not say who must test; your certification body judges the evidence. A CERT-In empanelled auditor is needed only when a regulator, tender or contract in your case adds that condition. See the section on When an empanelled auditor is not required above.
What questions should I ask a penetration testing vendor?
Ask what exactly will be tested, how much of the work is manual, whether you can see a sample report, who will test, how findings are confirmed, what the retest terms are, how credentials and data are handled, whether the firm has any conflict in your scope, whether the report fits your auditor's requirement, and what happens if testing finds something critical. See the section on Questions to ask a penetration testing vendor above.
What are the red flags in a VAPT proposal?
A price given before anyone has asked what you run, a scope described only as complete VAPT, no sample report, no named testers, retest terms that appear only later, no non-disclosure agreement, and any promise that you will pass an audit or become certified because of the test. See the section on Questions to ask a penetration testing vendor above.
Is BERRY9 CERT-In empanelled?
No. If a regulator, tender or contract requires an empanelled auditor, that piece of work goes to another firm, and we say so before any payment. For SOC 2, ISO 27001, DPDP Act and customer-questionnaire evidence, where no such condition applies, BERRY9 can run the test. See the section on When do you need a CERT-In empanelled firm? above.
How much should a VAPT cost in India?
It depends on the size of the scope: how many applications, user roles, endpoints, hosts and environments it covers, and how much of the work is manual. BERRY9 prices its starter scope from INR 9,000 + 18% GST for small scopes such as 3 to 5 external IP addresses or a simple WordPress website, including a vulnerability scan, manual checks, a written report and one free retest; every other test starts from INR 27,000 + 18% GST. The BERRY9 VAPT cost guide covers what pushes a figure up or down. See the section on What a VAPT price tells you, and what it does not above.
Should the VAPT company also fix the vulnerabilities it finds?
It is cleaner when the testers did not build or run the systems they test, so they have nothing to defend. A testing firm should give you a clear fix for each finding and check your fixes afterwards; if the same firm also does the remediation, ask how the testing is kept independent of it. See the section on What a good VAPT company shows you before you sign above.
Plan your next security test
Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.
- +91 86868 92922
- contact@berry9.com
- H.No: 8-3-945/A/12 & 13, Sri Venkata Sai Nest Apartments, Nagarjuna Nagar Colony, Yellareddyguda, Hyderabad 500073, Telangana