VAPT services in Coimbatore
Penetration testing for Coimbatore's textile, engineering and component manufacturers, covering ERP and plant networks, connected machinery and the evidence export customers ask for, run remotely from our Hyderabad office, with on-site work at your Coimbatore premises by arrangement. Export questionnaires and plant networks decide the scope more often than compliance does.
- Our one office
- Hyderabad
- Coimbatore visits
- By arrangement
- Starter scope
- INR 9,000 + 18% GST
- Other tests
- INR 27,000 + 18% GST
Last reviewed
Pathinternet → F-01 → office LAN → F-02 → ERP server → F-03 → plant network
Also mappeddealer portal
- F-01A vendor's remote-support tool on the office router answers from the internet and shares one password across customersHigh
- F-02Office PCs and the ERP server share one flat segment, with no firewall rule between themMedium
- F-03The machine-data gateway opens its admin panel to anyone on the ERP segment, with no sign-inHigh
- ChainThree ordinary gaps line up into a route from the internet to the machines on the shop floorCritical
01 / Industries
What Coimbatore's industries run, and where testing fits
Coimbatore, often called Kovai, built its economy on making things. It is widely known for textile mills and the machinery that serves them, for pumps, motors and other engineering goods, and for foundries and component makers that supply the auto and industrial trades, with a software and IT services sector growing beside them. None of this describes BERRY9 clients; it is public background on the city's economy, and it shapes what a test here usually covers.
Textile mills and processing units
A spinning, weaving or processing business usually runs an ERP for orders, yarn stock and dispatch, a few office PCs that reach it, and remote access for the accountant, the software vendor or the owner on the road. Each of those openings was added for convenience and is seldom looked at again. An external and internal network test shows which of them an outsider could use.
Pump, motor and engineering makers
For an engineering firm the valuable files are drawings, design data and costing sheets, kept on file servers and CAD workstations that most of the office can browse. Dealers and service partners may reach a portal or a shared folder from outside. A test answers a plain question: who, starting from where, can read or change those files?
Foundries and component suppliers
Suppliers to carmakers, tractor makers and other industrial buyers exchange schedules, quality records and drawings with those customers, sometimes through the customer's own portal and sometimes over email and shared drives. The customer's supplier-security rules then reach into the supplier's network, and that is where testing comes in.
Machinery that reports to the cloud
Machine builders increasingly fit sensors, gateways and controllers that send running data to a dashboard or a phone app. For the buyer that connectivity is a feature; for anyone who finds the gateway online with its factory password unchanged, it is a way in.
Exporters answering overseas buyers
Garment, textile and engineering exporters sell to customers abroad whose procurement teams send vendor-security questionnaires before a contract or at renewal. The rows ask about testing, patching and access, and the customer expects evidence behind each answer.
Software and IT services firms
The city's software companies build and run applications for clients in India and overseas. Those clients ask for test results on what is delivered, and sometimes on the environment where it is built.
02 / Customer questionnaires
When an export customer sends a security questionnaire
For a Coimbatore exporter, the request for a test often arrives as a spreadsheet of questions from a buyer's procurement or security team. The rows differ from one customer to the next, but most come back to a few points, and a penetration test report answers several of them directly.
| What the customer asks | What the report gives you |
|---|---|
| Have your internet-facing systems been tested independently, and when? | A dated report from an outside tester, with the systems in scope named. |
| How do you find and fix vulnerabilities? | Every finding with a severity score, reproduction steps and a fix, and a remediation matrix for tracking closure. |
| Who can reach your network from outside, vendors included? | Results of the external test, covering VPN gateways, remote-desktop services and vendor support tools in scope. |
| Is the network separated, so one infected PC cannot reach everything? | Internal test findings on the boundaries between office PCs, servers and the plant. |
| Were last year's issues fixed? | Retest results that show which findings are closed, where a retest is part of the engagement. |
A test does not answer every row. Questions on written policies, staff training, backups or insurance need your own documents, and the customer alone decides what evidence it accepts. BERRY9 can help you fill in the questionnaire as well as supply the test report.
Before the scope is fixed, it pays to ask the customer which systems they want covered and how recent the report must be. A test aimed at the questions they actually ask costs less than one that covers everything.
03 / Price
VAPT price in Coimbatore, published up front
Many buyers compare figures first, so both starting prices are on this page instead of being held back for a sales call. Neither includes GST, and your own figure goes into a written proposal once scoping is done.
Starter scope
Starts fromINR 9,000 + 18% GST
The starter scope is priced from INR 9,000 + 18% GST for small scopes such as 3 to 5 external IP addresses or a simple WordPress website, including a vulnerability scan, manual checks, a written report and one free retest.
Read the VAPT cost guideEvery other test
Starts fromINR 27,000 + 18% GST
Every other test starts from INR 27,000 + 18% GST: network, wireless, IoT and firmware, thick-client and web application tests among them. The final price is set in a written proposal after scoping.
Ask for a written proposalFor a typical Coimbatore business, the starter scope means the company website, if it is a simple WordPress site, or the 3 to 5 external IP addresses where the office firewall, the VPN and the mail server answer. It suits a mill or workshop that has never had a test and needs a written result to show a customer.
Above the starting price, four things set the figure:
Plants and warehouses
Every location with its own network, firewall or Wi-Fi adds hosts and boundaries to the work.
Logins and roles
ERP front ends, dealer portals and apps each carry users with different rights, and each set is tested.
Device models
Each model of gateway or connected product needs its own firmware and interface work.
Days at your premises
Wireless work and anything else that needs a visit is written into the proposal as its own line.
The VAPT cost guide for India breaks each kind of test into what is counted and what pushes the price up, which helps when two proposals describe the same work in different words.
The starting price for small scopes includes one free retest. For larger scopes, the retest terms are written into the proposal before work starts.
04 / Scopes
Tests that match a Coimbatore plant and office
A manufacturer's estate is rarely just a website. The tests below map onto what a mill, a pump maker or a component supplier actually runs; each links to the page with the full coverage.
Show details for Tests that match a Coimbatore plant and office
ERP and plant networks
From an ordinary user's access, we work through the ERP server, file servers, office PCs and the plant network as an intruder on the inside would: open shares, reused passwords, missing patches and any route from the office into production. The external half covers firewalls, VPNs and whatever else answers on your public addresses.
Wi-Fi across sheds and offices
Large sites often stretch one Wi-Fi network over offices, sheds and warehouses, sometimes on a shared password that has not changed in years. A wireless test checks whether someone beyond the gate could join it, and what they could reach once on. It always needs a tester on site.
Connected machines and products
For a maker that ships connected products, we test the device, its firmware, the companion app and the cloud service it reports to. For a plant that buys connected machines, the same work shows what each gateway exposes on your network. We stop at those gateways and the networks around the line; the PLCs, drives and machine controllers themselves are outside our scope.
Desktop ERP and accounting clients
Many ERP, accounting and production-planning packages run as installed Windows programs that talk straight to a database. A database password stored beside the program, or permission checks that only the program enforces, can let any office user read or alter records outside their job.
Dealer portals and ordering sites
A dealer or distributor portal, a B2B ordering site, a warranty registration form or the company website is open to anyone. The test signs in under each role and tries to see other dealers' orders, change prices or reach the admin side.
Apps, APIs, domains and cloud
Service-engineer apps and the interfaces behind them get mobile app testing and API security testing. A Windows domain spread over several units suits Active Directory testing, and ERP or analytics moved to AWS, Azure or GCP suits a cloud security assessment.
A first test does not have to cover all of this. Many owners begin with what faces the internet and the ERP network, then add Wi-Fi, devices or portals once the first report shows where the gaps are.
05 / What you receive
How to judge the work before you commit
We do not publish client names or results. What you can check in advance is how we test and what you will receive, and both are published.
Show details for How to judge the work before you commit
How we test
Every engagement follows the same five phases, from agreeing the rules to reporting. See the methodology to know what will happen on your systems before it happens.
What a report looks like
See the sample report before you sign, and judge whether your IT team could work from its layout.
Every test ends with the same set of deliverables:
- An executive report in plain language for the owner, the directors and any customer who asks what was found and what it means.
- An engineering report for your IT staff or software vendor, where every finding carries a proof of concept that shows the issue instead of only describing it.
- A CVSS 3.1 score on every finding, so the urgent fixes are separated from the ones that can wait for the next maintenance shutdown.
- A remediation matrix that lists each fix with space for an owner and a date, which is also the record a customer or auditor may ask to see.
- A readout session where we take your team through the results and answer questions on each fix.
Finding F-03 · Internal network
Machine-data gateway opens its admin panel to the ERP segment with no sign-in
- Severity
- High
- Affected
- 10.20.4.15, gateway web panel
- Tested as
- An ordinary office user on the internal network
Steps to reproduce
- From a PC on the ERP segment, a scan of the agreed internal range finds a web panel on the gateway that collects data from the shop-floor machines.
- The panel opens straight to its settings page; it has no login of any kind.
- The settings page can change where machine data is sent and push new configuration to the connected machines, so anyone on the office network can reach the plant.
Fix
Put the gateway on a separate plant segment reachable only from named engineering PCs, turn on the panel's authentication with individual accounts, and ask the machine vendor for a firmware version that does not ship with the panel open.
Example layout, not client dataPlant network · Gateway
This page names no clients and shows no client results. The sample above is invented to show the format.
06 / Delivery
Run from Hyderabad, with visits to Coimbatore by arrangement
Our only office is in Hyderabad; BERRY9 has no office, staff or partner in Coimbatore, so most of the work travels over the network rather than by road. A visit is arranged for the parts that need someone at your site.
Scoping
A call, then a written proposal
We agree what is in scope, which systems are off limits, the hours when testing may run and who to call if something looks wrong. Testing windows can be set around shift changes, dispatch cut-offs and month-end closing. The proposal fixes the price, the schedule and whether any day needs a visit.
Remote
Testing from Hyderabad
Websites, portals, apps and public IP addresses are tested over the internet. For the inside of the network you provide a VPN login or a jump host on your network, and the test runs through it with an ordinary employee's level of access.
On-site
Days at your Coimbatore site
Wireless work, any plant network that cannot be reached remotely, and gateways installed on the shop floor need a tester at your premises. Those days are agreed at scoping and written into the proposal. Travel to Coimbatore and the stay there are billed at cost, and the proposal shows that sum before work starts.
Readout
Results walked through with your team
The reports are handed over and discussed in an online session that your IT person, your ERP vendor and the owner or plant head can join from wherever they are.
Testing plus reporting usually fits in 5 to 10 working days from kickoff on a typical scope. More sites, more applications or device work add time, and the proposal states the schedule.
07 / Standards
ISO 27001, customer contracts and the CERT-In question
Most Coimbatore requests for a test trace back to a customer, a certificate or a law. Below, for each one, is the part a penetration test plays and the part it cannot play, and where CERT-In comes into it.
Show details for ISO 27001, customer contracts and the CERT-In question
ISO 27001
Exporters often work toward ISO 27001 because an overseas customer asked for it. The 2022 edition's Annex A includes a control on managing technical vulnerabilities, and a test report whose findings are tracked to closure is one kind of evidence the certification auditor can look at. BERRY9 itself holds ISO/IEC 27001:2022 certificate 26MEQVU27; that certificate is ours and does not certify your organization.
Supplier clauses and TISAX
Large automotive and industrial buyers write security clauses into supplier agreements, and some European carmakers ask suppliers for a TISAX assessment label. A penetration test is not a TISAX assessment, but its findings and fixes support the information-security controls that such an assessment reviews.
DPDP Act
A business in India that handles digital personal data, from employee records to customer and dealer contacts, falls under the Digital Personal Data Protection Act, which expects reasonable security safeguards. A test shows whether that data can be reached by someone who should not have it.
The CERT-In question
If a regulator, a government tender or a contract asks for an audit by an empanelled firm, only a firm on CERT-In's published list can take on that work. BERRY9 is not CERT-In empanelled. For a supplier questionnaire, ISO 27001 evidence or a check of your own, the choice of tester is yours.
BERRY9 tests and reports. Certifying your organization against a standard belongs to an accredited certification body, and judging a supplier belongs to your customer.
08 / Other cities
City pages for the rest of South India
Coimbatore is one of seven cities with its own page. Each is served from the Hyderabad office in the same remote-first way, and Hyderabad is the only city where we have an office.
- VAPT services in Hyderabad
- VAPT services in Chennai
- VAPT services in Bangalore
- VAPT services in Kochi
- VAPT services in Visakhapatnam
- VAPT services in Vijayawada
The regional pages, VAPT services in South India and VAPT services across India, give the wider picture, while the offensive security services overview gathers all our tests in one place.
09 / Inquiry
Send your Coimbatore scope for a written proposal
List the systems you want tested, any mill, plant or warehouse where a visit might be needed, and the date your customer or auditor expects the report. If a questionnaire started this, mention which questions it asks. BERRY9 signs an NDA on request, so drawings or network diagrams can be shared under one.
To talk it through first, call +91 86868 92922 or write to contact@berry9.com.
10 / FAQ
Frequently asked questions
Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.
How much does a basic VAPT cost for a Coimbatore business?
The starter scope covers a company website built on plain WordPress, or 3 to 5 external IP addresses, and starts from INR 9,000 + 18% GST. Network, wireless, IoT and firmware, thick-client and web application tests start from INR 27,000 + 18% GST. A written proposal after a scoping call sets the final figure. See the section on VAPT price in Coimbatore, published up front above.
How many types of VAPT can a Coimbatore manufacturer choose from?
Each type is named after what it targets, so the count depends on how you split your estate. The usual ones are web application, mobile app and API tests, external and internal network tests, Active Directory, wireless, thick-client, IoT and firmware tests and cloud reviews, with source code review, red teaming and social engineering beyond them. A Coimbatore manufacturer usually starts with the network and the systems customers or dealers sign in to. See the section on Tests that match a Coimbatore plant and office above.
What does a penetration testing company do for a manufacturer?
With your signed authorization, it probes your systems the way an intruder would and reports how far it got. For a manufacturer that usually means the ERP, file servers holding drawings and costing, remote access used by vendors, Wi-Fi across the site, dealer portals and the gateways of any connected machines. Each finding comes with evidence and a fix, so your IT team or vendor knows what to change.
Will a penetration test report satisfy our overseas customer's security questionnaire?
It answers the questions on independent testing and vulnerability management, and often those on remote access and network separation too. Questions on policies, training, backups or insurance need your own documents. Your customer decides what evidence is enough, so ask them which systems and how recent a report they expect before the scope is fixed. See the section on When an export customer sends a security questionnaire above.
Can you test the IoT gateways and connected products on our machines?
Yes. We test the device's firmware, its web or app interface, the network services it opens and the cloud dashboard it reports to. That covers the connected product and its gateway, not the controllers that run the line, which stay outside our scope; any work near production runs only in windows agreed in writing.
Do we need a CERT-In empanelled auditor for our VAPT?
Only when a regulator, a government tender or a contract asks for one; in that case only an auditor listed by CERT-In can do the work, and BERRY9 is not CERT-In empanelled. If nothing in your situation asks for it, any competent independent tester can do the work, and the report is judged on its method and evidence.
Can BERRY9 send someone to our factory in Coimbatore?
Yes, by arrangement. Wi-Fi testing always needs a tester on site, and so do plant networks with no remote path and gateways installed on the line. Visit days are agreed during scoping and listed in the proposal; everything else is tested remotely from Hyderabad. See the section on Run from Hyderabad, with visits to Coimbatore by arrangement above.
Is BERRY9 based in Coimbatore, or does it have a branch in Kovai?
Neither. There is no BERRY9 office or branch in Coimbatore or Kovai; our one office is in Yellareddyguda, Hyderabad, and tests for Coimbatore clients are run from it. You can reach us on +91 86868 92922 or at contact@berry9.com.
How long does VAPT take for a small manufacturer?
For a small manufacturer's usual scope, allow 5 to 10 working days from kickoff; the reports come at the end. Several plants, many systems or device testing take longer, and the proposal gives the schedule. See the section on Run from Hyderabad, with visits to Coimbatore by arrangement above.
What will we receive at the end of the test?
An executive report for the owner and management, an engineering report in which every finding carries its own proof of concept and CVSS 3.1 severity, a remediation matrix that orders the fixes, and a readout session to go through the results with your team. See the section on How to judge the work before you commit above.