Offensive security services and VAPT in India
BERRY9 runs VAPT and offensive security tests in four groups (application security, infrastructure, adversary simulation and secure delivery) from its one office in Hyderabad. Which one you need depends on what you run and who is asking for the test, so start with the systems your customers or auditors care about and match each one to a test and a starting price.
- Starter scope from
- INR 9,000 + GST
- Every other test from
- INR 27,000 + GST
- Advanced scopes
- Priced after scoping
- Delivery
- Remote from Hyderabad
Last reviewed
Application security: web, mobile, API, thick-client and source code review.
Infrastructure: network, Active Directory, cloud, wireless, IoT and firmware.
Adversary simulation: red team and social engineering.
Secure delivery: DevSecOps and training for your teams.
01 / Application security
Application security testing
Application security covers the software people sign in to: websites and web apps, mobile apps, the APIs behind them, desktop clients and the source code itself. Broken access control and business-logic flaws tend to hide here, and a tester working through the application by hand finds them where a scanner does not.
- Core
Web application penetration testing
Customer portals, admin consoles and internal tools, tested both signed out and signed in as each role you name. The baseline is the OWASP Top 10 and ASVS; most of the effort goes into broken access control, tenant isolation and business-logic flaws.
- Core
Mobile application penetration testing
Android and iOS apps, examined from the signed build you ship: what the binary gives away, how the app behaves on a device while it runs, and the backend API it calls. Findings are checked against OWASP MASVS.
- Core
API security testing
REST, GraphQL and gRPC APIs, called directly as each role instead of through the app's screens. The sweep hunts for broken object-level authorization, mass assignment and rate limits that give way, using the OWASP API Security Top 10 as its map.
- Advanced scope
Thick-client penetration testing
Software installed on users' computers that talks to a back-end server. The test looks at how the program handles credentials and local files, and whether the server trusts requests that the client should never be able to send.
Source code review
Manual review backed by static analysis, aimed at authentication, authorization, cryptography, deserialization and secret handling. Each finding points to the file and line, with a fix written for that code.
02 / Infrastructure
Infrastructure penetration testing
Infrastructure is what your applications run on and your staff work inside: internet-facing hosts, the internal network, the Windows domain, cloud accounts, wireless networks and connected devices. The question here is how far an attacker gets once they reach the edge, or once they are already in.
- Core
Network penetration testing
An external test shows what is open to an attacker on the internet, such as exposed services, edge devices and VPN gateways. Internal and assumed-breach tests begin with an ordinary employee's access and follow lateral movement and gaps between network zones.
- Core
Active Directory penetration testing
The Windows domain itself. Kerberoasting, abusable permissions, certificate services mistakes and unsafe delegation are tried as routes from one ordinary account to control of the domain, and the report adds an AD hygiene checklist.
- Advanced scope
Cloud security assessment
Cloud accounts on AWS, Azure and GCP: virtual networks, peering, security groups and IAM, plus cloud-only routes such as reaching the instance metadata service through server-side request forgery or assuming an IAM role.
- Advanced scope
Wireless penetration testing
Wireless networks and rogue device detection. It is an on-site test, arranged with you, because the tester needs to be near enough to pick up your access points.
- Advanced scope
IoT and firmware testing
Connected devices and the firmware inside them: the services a device exposes on the network, how it receives updates, and what an attacker can learn by taking the firmware image apart.
03 / Adversary simulation
Adversary simulation: red team and social engineering
A penetration test tries to find as many weaknesses as it can in the assets in scope. An adversary simulation asks a different question: could a real attacker reach a specific objective, and would your people and your monitoring notice?
Show details for Adversary simulation: red team and social engineering
- Advanced scope
Red team assessment
An objective-driven exercise: reach a named dataset, an admin panel or control of the domain, by any route the scope allows. It suits a security team that already has detection in place and wants to see how it responds to realistic attacker behavior.
- Advanced scope
Social engineering assessment
How staff respond to phishing emails, pretext phone calls and other attempts to deceive them. Run properly, it is a consented exercise: the organization authorizes it in writing, and the rules of engagement name who may be contacted and how.
BERRY9's tests are penetration tests unless a red team is scoped. An objective-driven scenario, such as reaching the admin panel from outside with no account, can be built into a penetration test; full red-team work, run covertly over a longer window, is a separate scope.
04 / Secure delivery
Secure delivery and training for your teams
Secure delivery is about catching problems before they ship. It covers security checks built into the way your software is built and released, and training for the people who write and run it.
Show details for Secure delivery and training for your teams
- Advanced scope
DevSecOps services
Security tests shifted left into the CI/CD pipeline, so problems are caught while a build is being made instead of waiting for the next penetration test.
- Training
Cyber security training for teams
Hands-on labs built around your stack, for the developers and engineers who build and run your systems. Hacking Trainer Academy is BERRY9's cyber security training division.
For a review of the code itself rather than the pipeline that builds it, see source code review under application security.
05 / Compliance-driven testing
Testing for SOC 2, ISO 27001, PCI DSS and other frameworks
Many tests are bought because an auditor, a customer or a framework asks for evidence. Each framework treats testing differently, so the cards below say what each one asks for and link to the page that covers it.
Show details for Testing for SOC 2, ISO 27001, PCI DSS and other frameworks
SOC 2
SOC 2 does not require a penetration test. Its criteria ask for controls that find and manage vulnerabilities, penetration testing is one common way to show that, and your auditor decides what evidence is enough.
ISO 27001
Under ISO/IEC 27001:2022, control 8.8 in Annex A deals with managing technical vulnerabilities. A penetration test report and the record of what was fixed are common evidence for that control; the certification body decides what it accepts.
PCI DSS
Under PCI DSS 4.x, requirement 11.4 covers external and internal penetration testing, and testing of segmentation controls wherever segmentation is used to shrink the scope of the cardholder data environment.
DPDP Act
Passed in 2023, India's Digital Personal Data Protection Act puts a duty on each data fiduciary to take reasonable security safeguards against personal data breaches. The Act does not prescribe penetration testing; a test is one way to show the safeguards are checked.
HIPAA
HIPAA is a US law. Indian healthtech and services companies that handle patient data for US healthcare customers are often asked for testing evidence to support the risk analysis its Security Rule calls for.
TPN Gold Shield
The Trusted Partner Network assessment sets the content security bar for VFX and post-production vendors that work on major studio content. Vulnerability management, including periodic penetration testing, is part of what it reviews under digital security.
For any of these, start the scope from the auditor's or customer's written requirement. BERRY9 tests and reports; it does not audit, certify or decide what an auditor accepts.
06 / How to choose
Which security test do I need?
Start from what you run and who is asking for the test. Four questions settle most scopes, and the table after them maps common situations to a first test.
Show details for Which security test do I need?
Scan or manual test?
A vulnerability scan runs automated checks against known patterns: outdated software, missing patches and common misconfigurations. A manual penetration test puts an engineer on top of that, to confirm what is real, chain weaknesses together and look for the access-control and business-logic flaws a scanner cannot reason about. A scan alone suits a quick hygiene check; a report that a customer or auditor will read is better served by manual work.
What is in scope?
List the assets: applications and their roles, APIs and their endpoints, IP ranges, the domain, cloud accounts and any site with wireless. Then name the environment, production or staging, and anything that is off limits. A tight scope is what makes a price and a schedule meaningful.
What does the requirement say?
When an audit or a customer drives the test, get the requirement in writing first. Frameworks differ: some name penetration testing outright, others ask for vulnerability management and leave the choice of evidence to the auditor.
Outside in, or inside out?
An external test starts with nothing but the internet, the way an unknown attacker would. An assumed-breach test starts from a foothold inside, such as a staff laptop or a VPN account with an ordinary employee's access, because phishing, a stolen laptop or an insider can put an attacker there. Many organizations want both, scheduled at different times of the year.
| Your situation | Start with | Often added |
|---|---|---|
| Launching a web app or SaaS product | Web application test | An API test, if the front end calls a separate API |
| Shipping a mobile app | Mobile application test | A deeper API testThe mobile test already covers the backend API the app calls |
| A SOC 2 or ISO 27001 audit, or a customer security questionnaire | Tests of the applications and networks inside the audit or contract boundary | Cloud security assessment, for workloads in AWS, Azure or GCP |
| Taking card payments | PCI DSS testing: external, internal and segmentation | Application tests of the payment flow |
| An office network with a Windows domain | Internal network test | Active Directory test |
| A handful of internet-facing IP addresses (3 to 5), or a basic WordPress site | The starter scope | A web application test, once the site has logins and roles |
| A security team that wants to test detection and response | Red team assessment | Social engineering assessment |
| Developers who ship every week | Source code review | DevSecOps services |
| Desktop software installed for staff or customers | Thick-client test | An API test of the server it talks to |
| Connected devices in a factory, warehouse or lab | IoT and firmware test | Wireless test |
BERRY9 is not CERT-In empanelled. Where a regulator, tender or contract specifically requires a CERT-In empanelled auditor, you will need one; check that before you scope a test.
For the questions to put to any testing firm, see our guide on choosing a VAPT company in India; for how the two terms differ, read VAPT vs penetration testing.
Sector shapes a scope as much as technology does; the industries we secure page walks through it one sector at a time.
07 / Price ladder
Starting prices for every test
Prices follow scope, in three steps: a starter scope for small, well-defined targets, one starting price for every other test, and written proposals for the advanced scopes.
Show details for Starting prices for every test
Starter scope
Starts fromINR 9,000 + 18% GST
The starter scope is priced from INR 9,000 + 18% GST for small scopes such as 3 to 5 external IP addresses or a simple WordPress website, including a vulnerability scan, manual checks, a written report and one free retest.
- A vulnerability scan
- Manual checks
- A written report
Every other test
Starts fromINR 27,000 + 18% GST
Every other test starts from INR 27,000 + 18% GST, including:
- Web application
- Mobile app with its backend
- API
- Network
- Active Directory
- Source code review
- Tests for SOC 2, ISO 27001 or PCI DSS
Advanced scopes
PricedAfter scoping
Cloud accounts, red team, wireless, thick-client, IoT and firmware, social engineering and DevSecOps work: the final price is set in a written proposal after scoping.
Discuss an advanced scopeEach figure is a starting price before 18% GST, and larger scopes cost more, because every extra role, endpoint, host or environment adds testing time. The advanced scopes vary too much in depth for one starting figure, so none is published for them. For what moves a price, and how these figures sit against what other vendors publish, see the VAPT cost guide for India.
08 / Every engagement
What every engagement includes
Whichever test you choose, it runs through the same five phases and ends with the same set of reports. Only the depth and the tooling change with the target.
Show details for What every engagement includes
Phase 1
Scope
The assets, the rules of engagement, emergency contacts and the hard stops are agreed in writing before any testing.
OutputA written proposal and rules of engagement
Phase 2
Reconnaissance
Passive research first, then active mapping of hosts, services and technologies, so the test covers what is really exposed and not only what is documented.
Phase 3
Vulnerability identification
Manual testing and scanning side by side, with every automated result checked by an engineer before it can reach the report.
Phase 4
Exploitation and risk analysis
Findings worth keeping are proven with a proof of concept, and weaknesses that combine are followed as one attack path.
Phase 5
Reporting and remediation
The findings are written up for two readers, management and engineering, and each one is paired with its fix.
OutputReports and a remediation matrix
What you receive
- An executive report in plain language, for founders, managers and auditors.
- An engineering report that walks through each finding: how to reproduce it, the proof of concept, and the change that closes it.
- CVSS 3.1 severity, weighed for your architecture and the data at stake.
- A remediation matrix that lines up every finding against the change that fixes it, for your team to track until it is closed.
- Standards alignment with OWASP, NIST SP 800-115, PTES and MITRE ATT&CK.
The VAPT methodology describes each phase in full, and the sample VAPT report shows the format of the two reports.
09 / Where we work
One office in Hyderabad, testing across India
Tests are run from our one office in Hyderabad, with wireless and other on-site work by arrangement.
Show details for One office in Hyderabad, testing across India
Web apps, mobile apps, APIs and external networks are reached over the internet. Internal network, Active Directory and assumed-breach tests reach inside through a VPN account or a jump host at an ordinary employee's level of access. Wireless testing, and any test where remote access is not possible, happens at your premises by arrangement.
Location pages
Our office
H.No: 8-3-945/A/12 & 13, Sri Venkata Sai Nest Apartments, Nagarjuna Nagar Colony, Yellareddyguda, Hyderabad 500073, Telangana.
For a scope and timeline, contact BERRY9 or call +91 86868 92922.
10 / FAQ
Frequently asked questions
Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.
Which security test do I need?
Start with the systems your customers, auditors or regulators care about most. A web or SaaS product usually starts with a web application test, a mobile app with a mobile test that covers its backend API, an office network with an internal network test and Active Directory, and a handful of internet-facing addresses or a simple WordPress website with the starter scope. When an audit drives the test, scope it from the auditor's written requirement. See the section on Which security test do I need? above.
What is the difference between a vulnerability scan and a penetration test?
A vulnerability scan runs automated checks for known weaknesses and reports what matches. A penetration test adds an engineer who confirms which findings are real, proves their impact with a proof of concept, chains weaknesses together and looks for the access-control and business-logic flaws scanners cannot reason about. VAPT, short for vulnerability assessment and penetration testing, usually means the two together.
How many types of VAPT are there?
There is no fixed number, because VAPT is named after what is tested. BERRY9 groups its tests four ways: application security (web, mobile, API, thick-client and source code review), infrastructure (network, Active Directory, cloud, wireless, IoT and firmware), adversary simulation (red team and social engineering) and secure delivery (DevSecOps and team training). Tests are also described by where they start: external, internal or assumed breach.
Can VAPT be done remotely?
Mostly, yes. Web apps, mobile apps, APIs and external networks are reached over the internet from BERRY9's office in Hyderabad. Internal network and Active Directory tests reach inside through a VPN account or a jump host with an ordinary employee's access. Wireless testing needs a tester within radio range, so it is done at your premises by arrangement, as is any test where remote access is not possible.
How much do offensive security services cost in India?
At BERRY9, the starter scope is priced from INR 9,000 + 18% GST for small scopes such as 3 to 5 external IP addresses or a simple WordPress website, including a vulnerability scan, manual checks, a written report and one free retest. Every other test starts from INR 27,000 + 18% GST, and larger scopes cost more. Cloud accounts, red team, wireless, thick-client, IoT and firmware, social engineering and DevSecOps work are priced in a written proposal after scoping. See the section on Starting prices for every test above.
Is a red team assessment the same as a penetration test?
No. A penetration test tries to find as many weaknesses as possible in the assets in scope, working openly with your team. A red team assessment is an objective-driven simulation that tries to reach a defined goal, such as a specific dataset or control of the domain, often without the defending team being told in advance. Most organizations need a penetration test first; a red team suits a security team that already has detection in place. See the section on Adversary simulation: red team and social engineering above.
How long does a security test take?
A typical scope runs 5 to 10 working days from kickoff to report. Larger estates take longer, and the advanced scopes are scheduled in the written proposal before testing begins.
Plan your next security test
Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.
- +91 86868 92922
- contact@berry9.com
- H.No: 8-3-945/A/12 & 13, Sri Venkata Sai Nest Apartments, Nagarjuna Nagar Colony, Yellareddyguda, Hyderabad 500073, Telangana