VAPT services in Bangalore
BERRY9 runs VAPT for Bengaluru SaaS companies, product startups and GCC suppliers who need evidence for SOC 2, ISO 27001 or an enterprise customer's security questionnaire, with the testing run remotely from Hyderabad, our only office, and on-site work by arrangement. Web, API, mobile and cloud tests start from INR 27,000 + 18% GST, and each finding is reported with a working proof of concept, a severity score under CVSS 3.1 and the fix your developers need.
- Delivery
- Remote from Hyderabad
- On-site in Bengaluru
- By arrangement
- Small scopes from
- INR 9,000 + 18% GST
- Product tests from
- INR 27,000 + 18% GST
Last reviewed
| Function | A admin | A member | B member |
|---|---|---|---|
| Open workspace A dashboards | Allowed, as designed | Allowed, as designed | Refused, as designed |
| Invite users to workspace A | Allowed, as designed | Refused, as designed | Refused, as designed |
| Export workspace A records | Allowed, as designed | Finding: allowed, but should be refused | Finding: allowed, but should be refused |
| Change workspace A SSO settings | Allowed, as designed | Refused, as designed | Refused, as designed |
| Read workspace A audit log | Allowed, as designed | Refused, as designed | Refused, as designed |
- A memberExport workspace A records: allowed, but should be refused
- B memberExport workspace A records: allowed, but should be refused
01 / Why test
From a procurement review to a Bangalore penetration test
For a product company in Bengaluru, the first request for a penetration test frequently arrives inside a vendor security questionnaire, when an enterprise customer's procurement review asks for a recent independent test before the contract is signed. Many of the city's software product companies, startups and suppliers to global capability centers sell to customers who check their vendors this way. Procurement is not the only route, though; these are the moments a test tends to be requested.
An enterprise customer's security questionnaire
A large customer's procurement team sends a vendor security questionnaire. Between the questions on encryption, access and incident handling sits one about independent testing: when was the product last tested, by whom, and were the findings fixed? A recent report with a record of what was closed answers it with evidence instead of a policy statement.
A first SOC 2 or ISO 27001 audit
Product companies selling to customers in the United States and Europe often work toward SOC 2, and those selling to large or regulated buyers toward ISO 27001. Both programs look for a working way of finding and fixing vulnerabilities, and an outside test is a common piece of that evidence.
Funding or acquisition due diligence
Investors and acquirers may ask how the product's security has been checked. Running a test before the data room opens leaves time to fix what it finds, rather than explaining open findings to the other side of the table.
A launch or a major release
A new product, a public API, a mobile app heading to the stores or a move to a new cloud architecture changes what an attacker can reach. Testing just before release catches access-control mistakes while the code is still fresh in the minds of the engineers who wrote it.
Supplying a global capability center
A global capability center is a multinational's own technology or operations unit in India. A firm that builds software or runs services for one often goes through the parent company's third-party risk review, which can ask for a recent penetration test of the systems that touch the parent's data.
After an incident or a near miss
A leaked key in a public repository, a burst of suspicious logins or a bug report from a stranger that turned out to be real often prompts a wider look. A test then checks whether the same class of weakness exists elsewhere in the product.
02 / What gets tested
What a Bengaluru SaaS product gets tested first
For a software product, the first test usually covers what customers sign in to and what holds their data: the web application, its APIs, the mobile app if there is one, and the cloud account underneath. Each card links to the full service page.
Web application penetration testing
In a multi-tenant product, tenant isolation is the line that matters most. We sign in as users from different customer accounts and roles and try to cross every boundary between them: reading another tenant's records by changing an identifier, reaching admin screens from a member login, or skipping a step in billing, approval or invitation flows. Single sign-on, session handling and password reset get the same hands-on treatment.
API security testing
Public APIs, partner integrations, webhooks and the endpoints behind a single-page front end often outnumber the screens a user ever sees. Each one is called with every role's token and with none, checked for object-level and function-level authorization gaps, and scripted against to see how keys, tokens and rate limits hold up.
Mobile application penetration testing
When the product has an Android or iOS app, the test starts from the build you publish to the stores. It looks at what the app leaves on the phone, how it handles tokens and certificate checks, and whether the backend enforces the rules that the app's screens only suggest.
Cloud security assessment
Product teams commonly build on AWS, Azure or Google Cloud. Reviewing the account means reading how identities, storage, network rules and secrets are configured and working out what an attacker could do with them, because one over-broad role or a public bucket can undo a well-tested application.
Source code review
A review of the code itself complements testing the running product. It suits teams that want each finding traced to the exact file and line, and fast release cycles where the same mistake tends to reappear in new features.
DevSecOps security
Teams that ship several times a week sometimes ask how to keep security checks running between tests. This work looks at the build and release pipeline: secrets, dependency checks, the permissions of the CI system and the gates a change passes on its way to production.
Offices still matter too. GCC suppliers and IT services firms whose staff work on a Windows domain usually add network penetration testing and Active Directory penetration testing to the product tests. Every test BERRY9 offers is listed on one page: offensive security services.
03 / Compliance
SOC 2, ISO 27001, DPDP and customer questionnaires
Bengaluru buyers usually arrive with a framework or a customer's name attached to the request. This is what each one asks for, and where a penetration test report fits into it.
Show details for SOC 2, ISO 27001, DPDP and customer questionnaires
SOC 2
For a SaaS company working toward a Type 2 report, two points are worth settling with the auditor first: where the test should fall relative to the audit period, and which systems sit inside the boundary the report describes.
ISO 27001
The 2022 revision of ISO/IEC 27001 has an Annex A control, 8.8, for managing technical vulnerabilities. Test findings that your ISMS tracks to closure are one way to show that control at work; what the certification body accepts is its own decision. BERRY9 itself holds ISO/IEC 27001:2022 certificate 26MEQVU27; that certificate is ours and does not certify your organization.
DPDP Act
Under the Digital Personal Data Protection Act, 2023, the data fiduciary must protect the personal data it holds by taking reasonable security safeguards against a breach. A consumer app, or a business product that stores its customers' user data, can use a test to see whether that data is within reach of someone who should not have it, and keep a dated record that the check was made.
Customer security questionnaires
Questionnaires from enterprise customers, whether an industry format or the customer's own, often ask for the date of the last independent penetration test, what it covered and where its findings stand. The customer decides what it accepts, so ask early whether they want the full report, the executive report alone or something shorter.
Fintech and healthtech products may meet two more frameworks. PCI DSS has its own penetration testing requirement (11.4) for the systems in its scope, and HIPAA can apply when a product handles protected health information for US healthcare providers or health plans.
Our part is the test. BERRY9 does not audit or certify your company, and audit outcomes rest with your auditor or certification body.
04 / Choosing a firm
Comparing a boutique firm with a big-name vendor
Bengaluru shortlists often hold a large, well-known security vendor and a smaller specialist firm side by side. Either can be the right choice. What decides it is what your customer, auditor or regulator needs, and how each firm answers six plain questions.
Show details for Comparing a boutique firm with a big-name vendor
- Who does the testing? Ask whether the people on the scoping call are the people who test, and how much of the work is hands-on rather than a scanner's export with a logo on it. At BERRY9, the testing is manual, supported by tools.
- What will the report look like? Ask for a sample before you sign. A BERRY9 test produces two reports, one executive and one for engineers; every finding includes the proof of concept, a CVSS 3.1 rating and the fix, and a remediation matrix tracks closure. See the sample VAPT report and the VAPT methodology.
- Is a retest part of the price? Settle it before work starts, not after the findings arrive. Our retest terms are in the price section of this page.
- Is the price in writing? A written proposal for your exact scope is easier to compare than a day rate or a range.
- Does anyone require a specific credential? Some regulators, tenders and contracts require an empanelled auditor. If yours does, that settles the choice, whoever else is on the shortlist; BERRY9 is not CERT-In empanelled.
- What happens to our data? Ask how test accounts, credentials and findings are stored, and when they are deleted after the engagement. BERRY9 signs an NDA on request.
Our guide to choosing a VAPT company in India goes through these questions in more depth.
05 / Remote delivery
How remote delivery from Hyderabad works
Everything on this page is delivered from Hyderabad, where BERRY9's only office is; there is no BERRY9 office or team in Bengaluru. For the tests a product company usually needs, that changes little: testing reaches your systems over the internet or through access you grant and can revoke, and the conversations happen on video calls.
Show details for How remote delivery from Hyderabad works
Before kickoff
Scoping call
An online call to agree what is in scope, whether staging, production or both are tested, the testing windows and the contacts on both sides if anything looks wrong. The written proposal that follows sets the price and the dates.
Access
Accounts and access
For web, API and mobile tests you create test users for each role and, on a multi-tenant product, in at least two tenants. A cloud review needs a read-only role in the account. Internal network and Active Directory tests connect through a VPN login or a jump host with the access an ordinary staff member has.
Testing
Testing from Hyderabad
The work runs from our Hyderabad office against the agreed scope and inside the agreed windows. If testing turns up a critical finding, your named contact hears about it straight away rather than waiting for the report.
Reporting
Executive and engineering reports
The executive report is written for management and for your customers' reviewers and auditors. The engineering report gives your developers the steps to reproduce each finding, its CVSS 3.1 score and the fix, and the remediation matrix lists what is open and what is closed.
Readout
Readout on a video call
We go through the findings with your engineers on a call. Whoever owns each fix can question it there and then, and the team leaves with an agreed order of work.
Remote by default
Web applications, APIs, mobile apps, cloud accounts and external networks are reached from Hyderabad over the internet, the same route an outside attacker would take. Nothing needs to be installed at your Bengaluru office.
On-site by arrangement
Wireless testing has to happen within radio range of your premises, and some internal networks cannot be opened remotely. In those cases a visit to your Bengaluru location is arranged during scoping. Travel and accommodation for that visit are billed at cost, and the amount appears in the proposal before testing starts.
For a typical scope, plan on 5 to 10 working days once kickoff has happened. A product with several apps, many roles or more than one environment needs longer, and the proposal gives the schedule.
06 / Price
Price of VAPT in Bangalore
There are two starting prices, each stated before 18% GST. The one that applies turns on whether the scope is a small, fixed set of internet-facing assets or a product with users, roles and data behind a login.
Starter scope
Starts fromINR 9,000 + 18% GST
The starter scope is priced from INR 9,000 + 18% GST for small scopes such as 3 to 5 external IP addresses or a simple WordPress website, including a vulnerability scan, manual checks, a written report and one free retest.
Read the VAPT cost guideProduct and platform tests
Starts fromINR 27,000 + 18% GST
Every other test starts from INR 27,000 + 18% GST: a web application with logins and tenants, an API, a mobile app with its backend, a cloud account or a network.
Ask for a proposal3 to 5 external IP addresses, or the WordPress marketing site of a Bengaluru startup, fit the starter scope. A product with sign-in, tenants and an API needs the higher starting price instead. Neither figure is a ceiling: larger scopes cost more, and your figure is written into a proposal once scoping has made clear what is being tested.
For a SaaS product, four things move the figure:
Tenants and roles
Every role, and every tenant type such as trial, standard and enterprise, adds boundaries to try.
API surface
Public, partner and internal endpoints each need calling with each role's token.
Apps and platforms
A web app, an Android app and an iOS app are three front ends on one backend.
Environments
Staging alone, production alone, or both, and any separate regions or single-tenant deployments.
How a scope turns into a figure for each kind of test is set out in our guide to VAPT cost in India.
The starting price for small scopes includes one free retest. For larger scopes, the retest terms are written into the proposal before work starts.
07 / Other cities
VAPT in other South Indian cities
Each city page covers its own buyers and the questions they bring. Hyderabad is home to our office and our testers; every other city on this list is served remotely from there, with on-site work by arrangement.
- VAPT services in Hyderabad our office
- VAPT services in Chennai
- VAPT services in Kochi
- VAPT services in Coimbatore
- VAPT services in Visakhapatnam
- VAPT services in Vijayawada
Two wider pages cover the region and the country: South India VAPT services and VAPT across India. Anything not answered here can go through the contact page.
08 / Inquiry
Tell us what your customer or auditor asked for
Send the systems you want tested, the environment, the date the report is due and, if you have it, the questionnaire or audit request that started this. We use it to scope the test and write the proposal.
Prefer a conversation first? Phone +91 86868 92922 or email contact@berry9.com.
09 / FAQ
Frequently asked questions
Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.
Is there a BERRY9 office in Bengaluru?
No. There is no BERRY9 office in Bengaluru: we work from a single office, in Yellareddyguda, Hyderabad, and test Bengaluru clients remotely from there. When a test needs someone at your premises, such as wireless testing or an internal network that cannot be reached remotely, a visit to your Bengaluru location can be arranged.
Can a penetration test be done remotely for a Bengaluru company?
Yes. Anything reachable from the internet, such as web applications, APIs, mobile backends, cloud accounts and external networks, is tested from Hyderabad without a visit. Internal networks and Active Directory are reached through a VPN login or jump host that you set up for the test and can switch off when it ends.
Does SOC 2 require penetration testing?
SOC 2 does not require a penetration test. Its criteria ask for controls that find and manage vulnerabilities, penetration testing is one common way to show that, and your auditor decides what evidence is enough. For a SaaS company, a test before or during the audit period is a direct way to show that vulnerabilities are being found and fixed. Agree the timing and the systems in scope with your auditor before the test is booked.
Will our enterprise customer accept your report in their vendor security review?
That is the customer's decision. Before the test starts, ask their security team which systems they expect covered, how recent the report must be and whether they want the full report or the executive report alone. BERRY9 then scopes the test against that request, so the report answers the questions they actually asked.
Do we need a CERT-In empanelled firm for a SaaS security review?
Only if the requirement says so. SOC 2 and ISO 27001 do not call for CERT-In empanelment, and a customer's security review asks for whatever that customer decides, so ask the requester whether they name a CERT-In empanelled firm. SEBI's cybersecurity framework requires the regulated entities it covers to use a CERT-In empanelled auditor, and some government tenders require one too. BERRY9 is not CERT-In empanelled, so if a requirement names one, we say so before you pay.
How much does VAPT cost in Bangalore?
For a Bengaluru company, the starter scope is priced from INR 9,000 + 18% GST for small scopes such as 3 to 5 external IP addresses or a simple WordPress website, including a vulnerability scan, manual checks, a written report and one free retest. Tests of a product with sign-in, tenants or an API start from INR 27,000 + 18% GST, and the written proposal that follows scoping fixes the final figure for your scope. See the section on Price of VAPT in Bangalore above.
How quickly can a Bengaluru team get a penetration test done?
Testing and both reports for a typical scope take 5 to 10 working days after kickoff. A product with several apps, many roles or more than one environment takes longer, and the proposal sets the dates. See the section on How remote delivery from Hyderabad works above.
Can you test our staging environment instead of production?
Yes. Product teams often prefer staging so testing cannot touch customer data, and it works well when staging mirrors production closely. Some findings depend on production settings, such as cloud configuration or live third-party integrations, so staging, production or a mix of both is agreed during scoping.
Should we hire a large security vendor or a smaller firm?
It depends on what your customer, auditor or regulator asks for. If their requirement names a particular credential or an empanelled firm, that decides it. Otherwise compare who actually does the testing, how much of it is manual, a sample report, the retest terms and a written price for your exact scope.