VAPT services in India
BERRY9 is a VAPT and penetration testing company for buyers anywhere in India, covering web and mobile apps, APIs, networks, Active Directory, cloud accounts and more from a single office in Hyderabad. Prices start at INR 9,000 + 18% GST on a small scope and at INR 27,000 + 18% GST beyond it; in the report, every finding carries a CVSS 3.1 score, a proof of concept and the steps to fix it.
- Serves
- Buyers in any state
- Office
- Hyderabad, Telangana
- Small scopes from
- INR 9,000 + 18% GST
- Every other test from
- INR 27,000 + 18% GST
Last reviewed
BERRY9 is not CERT-In empanelled; the CERT-In section sets out when that matters.
Testing that feeds SOC 2, ISO 27001, PCI DSS, DPDP Act, HIPAA and TPN work, and customer security reviews.
One office, in Hyderabad, with clients in every other state tested remotely.
01 / Who needs which test
Matching each buyer to the right test
Across India, the reason a company wants a test usually decides its scope. The table pairs buyer situations that come up in every state with the test that answers each; every service has a page of its own with the details.
| Buyer situation | Test that answers it | Why that test |
|---|---|---|
| A SaaS or product company facing an enterprise deal or a first SOC 2 audit | Web application testing and API security testing | Buyers and auditors look first at how tenants are kept apart, how roles are enforced and what the interfaces behind the product allow. |
| A consumer app in banking, health, retail or travel | Mobile application testing | Tokens and personal data sit on handsets the company does not control, and the backend has to refuse whatever the screens merely hide. |
| Any business with offices, branches or a server room | Network penetration testing and Active Directory testing | First the perimeter as an outsider sees it, then how far one ordinary staff login can travel inside the Windows domain. |
| A company whose systems run on AWS, Azure or Google Cloud | Cloud security assessment | Identities, storage permissions and network rules in the accounts you own are where cloud estates most often leak. |
| A software team that releases every week or every sprint | Source code review and DevSecOps services | Flaws are cheaper to fix in the code and in the build pipeline, before a release reaches customers. |
| Desktop software that talks straight to a server or database | Thick-client testing | Installed clients for trading, ERP, billing or hospital work often trust the user's computer more than they should. |
| A plant, warehouse, campus or hospital with Wi-Fi and connected devices | Wireless testing and IoT and firmware testing | Radio coverage that spills past the boundary wall and devices running old firmware are common ways in. |
| An organization with an in-house security team ready to have its detection and response tried out | Red team assessment and Social engineering assessment | A written, authorized exercise with agreed stop conditions that tests people and response as well as systems. |
| Developers and IT staff who will fix what a test finds | Cyber security training for teams | Practical lab work on the classes of flaw that keep coming back, built around the team's own stack. |
Unsure where to begin? The offensive security services overview groups every test by family with its starting price, and a sensible first test is usually whatever outsiders can already log in to.
02 / Compliance asks
Compliance asks that come from anywhere in India
Some requests for a test have nothing to do with the city a company is in. These six turn up nationwide, and each has a page of its own.
SOC 2
SOC 2 does not require a penetration test. Its criteria ask for controls that find and manage vulnerabilities, penetration testing is one common way to show that, and your auditor decides what evidence is enough. Indian SaaS and services firms with customers in the United States meet this question more than anyone.
ISO 27001
IT exporters and their suppliers pursue certification in every state. Annex A control 8.8 deals with managing technical vulnerabilities, and a test whose findings are followed through to the fix is one way to demonstrate the control in operation; the certification body weighs the evidence.
PCI DSS
Merchants, payment firms and service providers that store, process or transmit card data come under PCI DSS 4.x, whose requirement 11.4 expects the card environment to be penetration tested from inside and outside at least yearly, and again whenever the environment changes significantly.
DPDP Act
Passed in 2023, with Rules that phase in its duties, the law covers every organization processing digital personal data in India and expects reasonable security safeguards. It names no particular test, yet a penetration test is a direct way to check whether those safeguards hold up.
HIPAA, for health-data exporters
Indian firms that handle protected health information for American hospitals, insurers or health-tech companies usually sign a business associate agreement. HIPAA does not name penetration testing, but the Security Rule's risk analysis is why those customers so often ask their vendors for a recent test.
TPN, for VFX and post-production
Studios that hand unreleased content to VFX, animation and post-production vendors expect them to go through the Trusted Partner Network assessment. Its digital security section covers vulnerability management, which includes penetration testing.
BERRY9 tests and reports. It does not certify, audit or assess your organization against any of these frameworks; that verdict belongs to your auditor or assessor.
03 / CERT-In
When you need a CERT-In empanelled auditor
CERT-In, India's national computer emergency response team, publishes a list of the information security auditing organizations it has selected, and some buyers can hire only from that list. BERRY9 is not CERT-In empanelled. Whether that matters depends on who asked for the test and why.
Show details for When you need a CERT-In empanelled auditor
| Buyer or trigger | What the rule usually says | Can BERRY9 do the test? |
|---|---|---|
| Entities regulated by SEBI, such as stock brokers, depositories and fund houses | SEBI's cybersecurity framework (CSCRF, 2024) requires regulated entities in its scope to have their cyber audits and VAPT done by CERT-In empanelled auditors. | No. |
| Government departments, and sites hosted on government infrastructure | Hosting and security rules often require that a CERT-In empanelled auditor check a site or application before it goes live. | No. |
| Public tenders and public-sector contracts | It depends on the document. Read the eligibility and technical clauses; some require an empanelled auditor and others ask only for an independent test. | Only if the tender does not require empanelment. |
| Banks, non-bank lenders, payment firms and insurers | The RBI's IT governance direction asks banks and the larger non-bank lenders within its scope for periodic vulnerability assessment and penetration testing by trained, independent testers. A lender's own policy, a payment rule or an insurance regulator's guideline may still require a CERT-In empanelled auditor. | Sometimes. Ask your compliance team in writing first. |
| Private companies answering customers, or working toward SOC 2, ISO 27001, PCI DSS, HIPAA or TPN | None of these frameworks asks for CERT-In empanelment. A customer contract might, so read its security clause. | Yes. |
BERRY9 is not CERT-In empanelled. If a rule, tender or regulator in your case requires an empanelled auditor, we tell you at scoping, so you can take the work to an organization on the CERT-In list instead.
The CERT-In directions of April 2022 apply widely to organizations operating in India, but they deal with reporting incidents, keeping logs and synchronizing clocks, among other things; on their own they do not order a penetration test. To check whether a firm is on the list, search the list on CERT-In's own website rather than relying on the firm's description of itself.
04 / Delivery across India
Testing for any state from a single Hyderabad office
Our only office is in Hyderabad; BERRY9 keeps no office or branch in any other city or state. A client elsewhere in the country goes through the same five phases as a client in Hyderabad; what changes is the route the testers use to reach the systems.
Phase 1
Scoping
A call fixes the systems in scope, the test windows, who to ring in an emergency and what must not be touched. For a team in another state this call does the job a site visit would; the proposal with price and dates follows.
Phase 2
Reconnaissance
From Hyderabad we map the domains, addresses, login pages and services your organization exposes, just as an attacker in any city would see them.
Phase 3
Vulnerability identification
Engineers work through the agreed scope by hand, with automated tools in support, and confirm every automated result before it is counted.
Phase 4
Exploitation and risk analysis
Weaknesses that hold up are proven with a working proof of concept, within the limits fixed at scoping, and smaller issues that combine are written up as a single path.
Phase 5
Reporting and remediation
The executive report, the engineering report and the remediation matrix, then a readout call with the people who will make the fixes.
Reached over the network
Internet-facing systems need only the agreed scope and test accounts. Internal networks and domains are reached through a jump host or VPN credentials with an ordinary employee's rights, which your team controls and turns off at the end.
Needs a visit
Wireless surveys, networks with no remote route and hardware that cannot be shipped need a tester at your premises. Such a trip is planned at scoping and appears in the proposal. Whatever the state, travel and stay are charged at cost, and the proposal states that figure before the work starts.
Paperwork and confidentiality
Scope notes, test credentials and reports are exchanged in writing, and on request BERRY9 puts a non-disclosure agreement in place before anything sensitive is shared.
One clock for the whole country
India keeps a single time zone, so a team in any state shares our working day for calls, test windows and the readout.
On a typical scope the whole engagement, from kickoff to the delivered report, lasts 5 to 10 working days for a client in any state. A bigger estate, such as several applications or networks in more than one city, takes longer, and the proposal carries the dates.
05 / Price
What a BERRY9 test costs anywhere in India
Two starting prices are published, and they hold in every state, with GST at 18% added to each. The deciding question is the size of the target: a few assets facing the internet, or a system where users and data sit behind a login.
Starter scope
Starts fromINR 9,000 + 18% GST
The starter scope is priced from INR 9,000 + 18% GST for small scopes such as 3 to 5 external IP addresses or a simple WordPress website, including a vulnerability scan, manual checks, a written report and one free retest.
Read the VAPT cost guideEvery other test
Starts fromINR 27,000 + 18% GST
Every other test starts from INR 27,000 + 18% GST: web, mobile, API, network, Active Directory, cloud, code, wireless, device and red team work.
Request a scoping callNeither figure is a package price. The written proposal that follows scoping sets the figure for your systems, and any time on site appears in it as a line of its own.
Across the country, the same four things move the figure:
- Roles and user types. Each extra kind of account, from customer to admin, is another set of permissions to check.
- Endpoints and screens. Every extra function or API call is one more input to try by hand.
- Hosts and address ranges. On network work, every server and address in scope adds effort.
- Environments and locations. Staging beside production, or networks in several states, add testing time.
The VAPT cost guide goes through the kinds of test one by one and explains what drives each price.
The starting price for small scopes includes one free retest. For larger scopes, the retest terms are written into the proposal before work starts.
06 / Choosing a firm
Questions to settle before hiring a VAPT company in India
Lists of VAPT companies in India are long, and the names on them differ in ways a list does not show. Five questions separate them quickly.
Show details for Questions to settle before hiring a VAPT company in India
- How much is done by hand? Ask what share of the work an engineer does and what a scanner does; a scan alone misses broken authorization and business-logic flaws.
- Can you see the report format first? A sample report and a written testing method say more about a firm than a wall of logos.
- What does the starting figure include? Ask whether a retest is part of it, exactly which systems it covers and what would push it up.
- Who is the tester allowed to be? If a regulator, tender or customer names a kind of auditor, settle that before you compare prices.
- How is your data handled? Ask where credentials and findings are stored, who can see them and whether a non-disclosure agreement is signed.
Our own answers: manual testing with automated help, the method and a sample report on this site, published starting prices, a plain statement of our CERT-In status, and an NDA on request. BERRY9 holds ISO/IEC 27001:2022 certificate 26MEQVU27 and ISO 9001:2015 certificate 26MEQVL30. Those certificates cover our own management systems, not yours.
A longer walk through the choice is the subject of a separate guide, choosing a VAPT firm in India.
07 / Regions and cities
The South India hub and the city pages
The city pages describe the buyers of seven southern cities in detail. Hyderabad alone holds our office; the other six cities, like every other state, are served from there.
- VAPT services in Hyderabad our office
- VAPT services in Bangalore
- VAPT services in Chennai
- VAPT services in Kochi
- VAPT services in Coimbatore
- VAPT services in Visakhapatnam
- VAPT services in Vijayawada
The South India hub compares the southern cities and the choice between a local and a remote firm. For every way to reach us, use the contact page.
08 / Inquiry
Send your scope from any state
Say what you want tested, which state or city the systems and people are in, whether a regulator, tender or customer named the kind of tester, and the date you need the report. Scope, schedule and price get agreed on a scoping call after that.
Rather start with a conversation? Phone +91 86868 92922 or send a note to contact@berry9.com.
09 / FAQ
Frequently asked questions
Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.
Is VAPT mandatory in India?
Not for every company. No general law orders all businesses to commission one, but some regulators, SEBI and the RBI among them, expect periodic testing from the entities they regulate, PCI DSS requires it where card data is handled, and customer contracts and tenders often ask for it. Check the rule or contract that applies to you. See the section on When you need a CERT-In empanelled auditor above.
Can BERRY9 carry out a CERT-In audit?
No. Because BERRY9 is not CERT-In empanelled, it cannot do an audit that a regulator, a government host or a tender requires to come from an empanelled auditor. It can test for SOC 2, ISO 27001, PCI DSS, DPDP Act, HIPAA and TPN work, and for customer security reviews, where no such rule applies. See the section on When you need a CERT-In empanelled auditor above.
How do we choose between VAPT companies in India?
Compare how much of the testing is manual, read a sample report and the written method, ask what the starting price includes and whether a retest is part of it, and confirm whether your regulator, tender or customer insists on a particular kind of tester. How your data and credentials will be handled matters too. See the section on Questions to settle before hiring a VAPT company in India above.
Can a company in another state hire a Hyderabad-based tester?
Yes. Internet-facing systems, from applications and APIs to mobile backends, cloud accounts and the external perimeter, are tested remotely, and internal networks through a jump host or VPN credentials that you control. Someone travels to you only for work that distance rules out, a wireless survey for example. See the section on Testing for any state from a single Hyderabad office above.
What does VAPT cost in India with BERRY9?
The starter scope, for a simple WordPress website or a few external IP addresses, is priced from INR 9,000 + 18% GST. Anything larger begins from INR 27,000 + 18% GST; the proposal written once the scope is clear fixes the final figure. See the section on What a BERRY9 test costs anywhere in India above.
Which compliance frameworks can a BERRY9 test report support?
A report can serve as evidence in SOC 2, ISO 27001, PCI DSS, DPDP Act, HIPAA and TPN work, and in answers to customer security questionnaires. Your auditor or assessor decides what evidence is enough; BERRY9 does not certify your organization. See the section on Compliance asks that come from anywhere in India above.
How many working days does a test need for a company in another state?
Expect 5 to 10 working days on a typical scope, counted from kickoff until the report arrives, wherever the client is. Several applications, sites in different cities or a large Windows domain run longer, and the proposal gives the extra days. See the section on Testing for any state from a single Hyderabad office above.
Do you serve companies outside South India?
Yes. The city pages cover the southern cities, but the remote model works for any state: the access routes, the documents and the starting prices are the same. A visit, where one is needed, is planned during scoping. See the section on Testing for any state from a single Hyderabad office above.