Question 1

What does VAPT cost in India?

Accepted Answer

B9ITS engagements start at USD 500. Scope drives the final fee — a single-app web pen test typically lands between USD 500 and USD 3,000; complex multi-service engagements scale accordingly. A draft statement of work with a fixed fee is delivered within one working day of the scoping call.

Question 2

How long does a VAPT engagement take?

Accepted Answer

5–10 working days for a typical engagement. A draft report ships on the final day, followed by a free retest pass after your team applies fixes.

Question 3

Is your testing manual or automated?

Accepted Answer

Manual-led with tool assistance. Scanners run as a baseline; every high or critical finding is hand-validated by an OSCP-certified engineer before it reaches the report. Reports never ship raw scanner output.

Question 4

Do you sign an NDA before the engagement?

Accepted Answer

Yes — NDA on day one, statement of work on day two. We are ISO 27001:2022 certified for information security management, and engagement data is handled accordingly.

Question 5

Are you ISO 27001 certified?

Accepted Answer

Yes. ISO/IEC 27001:2022 (certificate 26MEQVU27) for information security management, plus ISO 9001:2015 (certificate 26MEQVL30) for quality management. Both certificates are downloadable from the home page.

Question 6

Do you offer a free retest?

Accepted Answer

Yes. Every engagement includes one free retest after your team has applied fixes. The retest is a full re-validation of each finding, not a partial check.