VAPT services in Chennai
Penetration testing for Chennai's manufacturers and auto suppliers, banks and fintech firms, and IT services exporters, with visits to Chennai by arrangement and the testing itself run remotely from our Hyderabad office. Prices begin at INR 9,000 + 18% GST for small scopes and at INR 27,000 + 18% GST for every other test; a written proposal then sets the figure for your estate.
- Delivered from
- Hyderabad, remotely
- On-site in Chennai
- By arrangement
- Small scopes from
- INR 9,000 + 18% GST
- Every other test from
- INR 27,000 + 18% GST
Last reviewed
No Chennai office: every test is run from our one office, in Hyderabad.
A visit to your Chennai office, branch or plant is arranged when the work needs someone there.
01 / Why test
Why Chennai companies ask for a penetration test
In Chennai the request seldom starts inside a security team. It usually comes from outside, from a customer, a bank or an overseas client that wants written proof of testing, and lands with someone who then has to find the budget. Four triggers are common.
A carmaker's or industrial customer's supplier questionnaire
Automotive and industrial buyers often ask suppliers how they protect drawings, production schedules and the links between plant and customer systems. A supplier that swaps orders and forecasts with its customer over EDI or a portal is part of that customer's attack surface, so the questionnaire asks for evidence. A recent penetration test report is one of the simplest documents to hand over.
A bank's or regulated customer's vendor review
Banks, NBFCs, insurers and payment companies have to manage the risk their suppliers bring in. A software house, a collections agency or a service provider that touches their data can be asked for test results before a contract is signed or renewed. The expectation starts with the customer's regulator and can reach the vendor through the contract.
An overseas client of an IT services firm
IT services and engineering firms in the city deliver work for clients in the United States, Europe and elsewhere. Those clients attach security schedules to their master services agreements, and a clause asking for an independent yearly test of the delivery environment, or of the application under construction, often appears.
A budget that has to be approved first
Many buyers want the cost before anything else, because the money has to be signed off before the scope can be. Published starting prices, a plain list of what moves the figure and a written proposal make that approval faster. The VAPT cost guide for India explains, test by test, how scope becomes a price.
02 / Estates
Estates common in Chennai, and the tests that fit them
Chennai's economy mixes heavy industry with software and finance. The automotive and auto-component belt to the city's south-west, around Sriperumbudur and Oragadam, sits alongside electronics manufacturing; IT parks line Old Mahabalipuram Road; and the city has long been home to banks, NBFCs, insurers and their back offices. Businesses like these tend to run the systems below. None of this describes BERRY9 clients; it sketches the city's economy in general terms.
Plant and office networks
A manufacturer's office network, its plant network and its links to suppliers often grew up apart and were joined later. We review the segmentation between corporate IT, the systems that run production and partner EDI flows, and look for a route from an ordinary office laptop to the manufacturing execution system. The work stops at the IT network and its boundary with the plant: PLCs, HMIs and SCADA systems on the line are outside our scope.
Desktop and thick-client software
Branch banking tools, treasury and dealing terminals, ERP front ends and shop-floor clients are often installed applications that talk straight to a database or an application server. That design can leave credentials in the install folder, or rely on checks that only the client performs, and a web test never sees either.
Wi-Fi on factory floors and in warehouses
Handheld scanners, tablets on the line and visitor networks all depend on Wi-Fi. A weak or flat wireless setup can put someone in the parking lot on the same segment as production systems. Wireless testing only works from inside signal range, which makes it an on-site job every time, booked in advance.
Connected products and devices
Electronics and component makers that ship connected products, such as telematics units or smart meters, carry their firmware into every unit sold. Testing the device, its firmware and the cloud service it reports to before launch catches flaws that would otherwise need a field update to fix.
Customer apps, portals and APIs
Fintech apps, net-banking front ends, dealer and distributor portals and supplier portals are what outsiders can reach first. Web application testing, mobile app testing and API security testing cover the sign-in, the roles and the business rules behind them.
Windows domains spread across sites
A firm with a head office, several plants and regional branches usually runs one Windows domain or a forest of them, and years of growth leave stale admin accounts and old trusts behind. The test starts from one ordinary user account and follows the paths that lead to control of the domain.
Cloud accounts belong in the same picture once ERP, dealer systems or analytics move to AWS, Azure or GCP; the cloud security assessment covers that side.
03 / Where to start
What to test first when the budget is fixed
When one test has to cover the most important ground, the order matters more than the size. One sensible order moves from what anyone on the internet can reach toward the inside of the network.
Show details for What to test first when the budget is fixed
Start
What faces the internet
Exposed IP addresses, the company website, VPN gateways and remote-access portals. A handful of external addresses or a simple website fits the starter scope, the least expensive way to get a first written result in hand.
Next
What customers and partners sign in to
The customer app, the dealer or supplier portal and the APIs behind them. They hold the data a customer's questionnaire asks about, so testing them often answers the request that started the project.
Then
The inside of the network
An internal network or Active Directory test from an ordinary employee's access, including the boundary between office and plant networks where there is one.
When needed
The specialist scopes
Thick-client applications, Wi-Fi, connected devices and cloud accounts. Each is priced as its own scope. Add them when the estate, or a customer's request, calls for them.
Splitting the work this way lets each stage be approved on its own budget line, and what one stage finds often shows where the next should look. A stage can also be repeated a year later to show a customer that the earlier findings stayed closed.
04 / Compliance
ISO 27001, PCI DSS and RBI-regulated customers
Three compliance asks are common for Chennai companies: an ISO 27001 certificate the company holds or is working toward, the card-data rules of PCI DSS, and the expectations RBI sets for banks and finance companies, which can reach their vendors through contracts. Each card sets out where a penetration test helps with that ask and where its role stops.
Show details for ISO 27001, PCI DSS and RBI-regulated customers
ISO 27001
Annex A control 8.8 of ISO/IEC 27001:2022 deals with the management of technical vulnerabilities. A test report, with each finding tracked to closure inside your ISMS, is evidence a certification auditor can weigh; it is not a certificate in itself. BERRY9 itself holds ISO/IEC 27001:2022 certificate 26MEQVU27; that certificate is ours and does not certify your organization.
PCI DSS
Requirement 11.4 of PCI DSS v4.0.1 asks for internal and external penetration tests at least once every 12 months and after significant changes, plus tests of segmentation controls where segmentation shrinks the card-data scope. It covers the systems in the cardholder data environment and those that can affect it; how a merchant validates decides whether 11.4 applies, and compliance is assessed by a QSA or, for many merchants, through a self-assessment questionnaire, not by the tester.
RBI-regulated customers
RBI's directions on IT governance and cyber security expect the banks and larger NBFCs they cover to test their systems for vulnerabilities, and its rules on outsourcing IT services keep those entities answerable for their vendors' security, so a vendor may be asked for test results. For some RBI-regulated businesses, payment aggregators among them, the directions require the audit to be done by a CERT-In empanelled auditor. BERRY9 is not CERT-In empanelled.
SOC 2 and the DPDP Act
IT services firms with American clients meet SOC 2 requests. SOC 2 does not require a penetration test. Its criteria ask for controls that find and manage vulnerabilities, penetration testing is one common way to show that, and your auditor decides what evidence is enough. Any firm holding personal data of people in India also has the DPDP Act to think about, which expects reasonable security safeguards for that data.
When a regulator, a tender or a contract requires an empanelled auditor, only an auditor on CERT-In's list can carry out the test, and we tell you that at scoping rather than after the invoice. In every case BERRY9 tests and reports; certifying or auditing your organization is not something we do.
05 / Delivery
Remote delivery from Hyderabad, on-site in Chennai by arrangement
Our one office is in Hyderabad; BERRY9 keeps no staff, partner or office of any kind in Chennai. Most tests do not need anyone in your building; the table shows how each kind of test reaches a Chennai estate, and where a visit comes in.
| Test | How we reach it | Anything on-site? |
|---|---|---|
| Web application, mobile app and API | Over the internet, with test accounts for each role; mobile builds are shared as signed files. | No. |
| External network | Over the internet, against the IP ranges in scope. | No. |
| Internal network and Active Directory | Remotely, over a VPN login or from a jump host on your internal network, with the access a regular member of staff would have. | Only where remote access is not possible; then a testing laptop is placed on your network on-site. |
| Thick client | The installed client on a test machine that can reach its servers, set up as agreed during scoping. | Only when the client runs nowhere but on your premises. |
| Plant network and the IT/OT boundary | Through a jump host where the plant allows remote access. | Where the plant network has no remote path at all. |
| Wireless | A tester within radio range of your access points. | Yes, every time. |
| IoT and firmware | Firmware images and device samples sent to our Hyderabad office. | Devices that cannot leave your site are tested there by arrangement. |
Kickoff and readout can both be held online, so engineers, plant IT and management can join from wherever they sit, and either can be held at your Chennai office by arrangement. For any visit, travel to Chennai and the hotel stay are charged at cost, with the figure stated in the proposal before work begins.
Before any testing starts, these are fixed in writing:
- Signed rules of engagement and the exact assets in scope.
- Testing windows that keep clear of shift changes, production runs and month-end closing.
- Emergency contacts on both sides, including someone from plant IT where plant systems are in scope.
- Systems that are off limits, and what may not be touched on those that are in scope.
Testing and reporting for a typical scope fit into 5 to 10 working days from the kickoff. Several plants, many applications or a large domain push that out, and the proposal carries the schedule.
06 / Price
Price of VAPT in Chennai
Price is often the first question Chennai buyers ask, so both figures are set out plainly here. Both figures are starting prices before GST, and the figure for your estate is written into a proposal once the scope is clear.
Starter scope
Starts fromINR 9,000 + 18% GST
The starter scope is priced from INR 9,000 + 18% GST for small scopes such as 3 to 5 external IP addresses or a simple WordPress website, including a vulnerability scan, manual checks, a written report and one free retest.
Read the VAPT cost guideEvery other test
Starts fromINR 27,000 + 18% GST
Every other test starts from INR 27,000 + 18% GST, including thick-client, wireless, IoT and firmware, and cloud work; the final price is set in a written proposal after scoping.
Ask for a proposalFor a Chennai estate, four things usually decide where the figure lands above the starting price:
Sites and plants
Each location with its own network segment, firewall or domain adds hosts and boundaries to test.
Applications and roles
Every portal, app or desktop client, and every set of permissions inside it, is more ground to cover.
Specialist scopes
Wireless, thick-client, device and cloud work are separate pieces of effort, each with its own preparation.
Visits
Days at your premises, where the delivery table calls for them, are written into the proposal as their own line.
When several proposals are laid side by side, the VAPT cost guide for India shows what a VAPT price is made of, what drives it up and how to compare proposals that are worded differently, so a lower figure is not mistaken for the same work.
The starting price for small scopes includes one free retest. For larger scopes, the retest terms are written into the proposal before work starts.
07 / Other cities
Other city pages and the regional hubs
Every city below is served the way Chennai is: from the Hyderabad office, remotely, with visits by arrangement. Hyderabad is the one city where our team is based.
- VAPT services in Hyderabad
- VAPT services in Bangalore
- VAPT services in Kochi
- VAPT services in Coimbatore
- VAPT services in Visakhapatnam
- VAPT services in Vijayawada
For a regional or national view, read VAPT services across South India or VAPT services in India, and for every test we offer in one place, see all offensive security services.
08 / Inquiry
Ask for a proposal for your Chennai estate
Tell us which systems are in scope, whether any of them sit in a plant or branch that would need a visit, and when you need the report in hand. The scope and timeline are then agreed on a short call.
To talk it through first, call +91 86868 92922 or write to contact@berry9.com.
09 / FAQ
Frequently asked questions
Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.
Who can do VAPT testing for a Chennai company?
Any independent testing firm with the skills for your systems can, provided it works under signed authorization and a written scope. If your regulator or a tender requires a CERT-In empanelled auditor, only a firm on CERT-In's list will do, and BERRY9 is not on that list. Otherwise the choice comes down to method, the quality of the report and price.
Can VAPT be done remotely for a company in Chennai?
Yes, for most tests. Anything reachable from the internet, such as a web application, a mobile app with its backend, an API or an external IP range, is tested from our Hyderabad office without a visit, and internal network and Active Directory tests run over a VPN login or a jump host you place inside your network. Wireless testing, and plant networks with no remote path, are the exceptions; they are handled on-site by arrangement. See the section on Remote delivery from Hyderabad, on-site in Chennai by arrangement above.
Does BERRY9 have an office in Chennai?
No. We have no office in Chennai: our only office is in Yellareddyguda, Hyderabad, and Chennai clients are served from there. Calls go to +91 86868 92922 and email to contact@berry9.com.
How much does VAPT cost in Chennai?
A small scope of 3 to 5 external IP addresses, or one simple WordPress site, starts from INR 9,000 + 18% GST. Tests beyond the starter scope start from INR 27,000 + 18% GST, including thick-client, wireless, IoT and firmware, and cloud work; the final price is fixed in a written proposal after a scoping call. See the section on Price of VAPT in Chennai above.
What types of VAPT can a Chennai company order?
Web application, mobile app, API, external and internal network and Active Directory tests, plus thick-client, wireless, IoT and firmware testing and cloud security reviews. Source code review and red team exercises are also available. A common way in is to test what faces the internet first and add the rest stage by stage. See the section on What to test first when the budget is fixed above.
Can you test our factory or plant network?
We test the IT side of a plant: the segmentation between corporate IT and production systems, how exposed the manufacturing execution system is to the office network, and the partner EDI links that cross the boundary. Controllers, HMIs and SCADA systems on the line itself stay out of scope.
Is BERRY9 CERT-In empanelled?
No, BERRY9 is not CERT-In empanelled. Some regulators and tenders require an empanelled auditor; if yours does, you will need a firm on CERT-In's list. Our tests fit customer questionnaires, ISO 27001 and PCI DSS work, and internal assurance where no such requirement applies.
How many working days does a penetration test for a Chennai company need?
For a typical scope, 5 to 10 working days from kickoff, with the reports at the end. Several plants, many applications or a large domain take longer, and the schedule is set in the proposal.
Will a penetration test make us ISO 27001 or PCI DSS compliant?
No test does that on its own. The report is evidence: an ISO 27001 certification auditor or a PCI DSS assessor weighs it alongside everything else. BERRY9 tests and reports; certification and audit decisions stay with your auditor or assessor.