VAPT services in Kochi
Penetration testing for Kochi's technology firms, hospitals, logistics businesses, travel and hotel booking platforms and Kerala's banks and NBFCs, with visits to Kochi when the work needs a person there and everything else run remotely from our one office in Hyderabad. The sample report and method are on this site; read them before the first call.
- Testing runs from
- Our Hyderabad office
- Visits to Kochi
- By arrangement
- Small scopes from
- INR 9,000 + 18% GST
- Every other test from
- INR 27,000 + 18% GST
Last reviewed
Finding F-01
Another guest's booking opens when the reference number is changed
- Severity
- High
- Affected
- Booking confirmation API
- Tested as
- Signed-in guest
Steps to reproduce
- Sign in as guest A and open a confirmed booking; the request carries the booking reference.
- Send the same request with the next reference number.
- The response returns guest B's name, phone number and stay dates.
Fix
Check on the server that the booking belongs to the signed-in guest, and issue booking references that cannot be guessed.
Example layout, not client dataScored with CVSS 3.1 in a real report
01 / Delivery
An out-of-town tester, stated plainly
BERRY9 is not a Kochi firm. Our only office is in Hyderabad, and we would rather say so at the start than have you find out at kickoff. Most tests need nobody in your building, and the few that do are planned for in advance. Each system is reached in one of three ways.
Reached over the internet
Websites, booking engines, patient and customer portals, mobile apps with their backends, APIs and the public IP addresses of an office or a hospital. These are tested from Hyderabad by the same route an outsider would use, so nothing has to be installed in Kochi and nobody has to travel.
Reached through a door you open
Internal networks, Windows domains and the systems a hospital or a bank branch keeps off the internet. Your team sets up a VPN account or a jump host carrying no more rights than a regular member of staff, and the test begins from that foothold, still run from Hyderabad.
Reached only in person
Wi-Fi in a hotel, a resort, a hospital or a warehouse can only be tested from within radio range, and a few networks have no remote path at all. For those, an engineer travels to Kochi on dates agreed during scoping. The journey and the hotel are billed at cost and listed in the proposal before the work begins.
Six questions are worth putting to any tester who is not based in Kochi. Here are our answers:
| Question | BERRY9's answer |
|---|---|
| Where does the testing team sit? | In our one office, in Yellareddyguda, Hyderabad. We have no office, staff or partner in Kerala. |
| How do you get to systems that are not on the internet? | Over a VPN connection, or from a jump host, that you create and can switch off at any moment, limited to what a regular employee could reach. |
| When would someone come to Kochi? | When wireless is in scope, or when a network cannot be opened remotely. The visit is agreed during scoping and written into the proposal. |
| What do we hold at the end? | An executive summary for management, an engineering report that gives every finding its own proof of concept, CVSS 3.1 score and fix, and a remediation matrix. |
| Will you sign our NDA? | Yes. BERRY9 signs an NDA on request. |
| Can we see the format before we sign? | Yes. See the sample VAPT report and our VAPT methodology. |
02 / Price
What VAPT costs for a Kochi business
Both starting prices are on the page before any call, because a buyer weighing a firm from another state should not have to ask for them. The figures are before GST, and they are where a proposal begins, not where it ends.
Starter scope
Starts fromINR 9,000 + 18% GST
The starter scope is priced from INR 9,000 + 18% GST for small scopes such as 3 to 5 external IP addresses or a simple WordPress website, including a vulnerability scan, manual checks, a written report and one free retest.
Read the VAPT cost guideEvery other test
Starts fromINR 27,000 + 18% GST
Every other test starts from INR 27,000 + 18% GST: booking platforms, apps, APIs, internal networks, Windows domains, Wi-Fi and cloud accounts alike.
Ask for a proposalA homestay's or tour operator's simple WordPress site, or a clinic's 3 to 5 external IP addresses, is the kind of job the starter scope was made for. A booking engine with guest logins, an app for patients or a lender's customer portal is not, and starts at the second figure. Neither figure is a ceiling; the price for your systems goes into a proposal after the scoping call has settled what is tested.
What moves a Kochi figure up from the starting price:
Booking and payment flows
Search, hold, pay, amend and cancel are separate paths, and each one can be abused in its own way.
Apps and their platforms
An Android app, an iOS app and a web front end on one backend are three surfaces to test, with one shared API behind them.
Integrations
Channel managers, payment gateways, insurer and lab links, and partner APIs each widen what has to be checked.
Sites and visits
Every hospital block, branch or warehouse with its own network adds hosts, and days spent at your Kochi sites are a line of their own.
The guide to what VAPT costs in India takes each kind of test in turn and shows how its scope becomes a price, which helps when proposals from different firms describe the same work in different words.
The starting price for small scopes includes one free retest. For larger scopes, the retest terms are written into the proposal before work starts.
03 / Sectors
Kochi businesses and the tests that suit them
Kochi's economy has several strands. Infopark at Kakkanad and the city's other IT campuses hold many software and IT services companies; the port and its container terminal make the city a hub for shipping, logistics and exports such as seafood and spices; its hospitals draw patients from across Kerala and beyond; tourism keeps hotels, resorts and booking businesses busy; and several banks and NBFCs have their head offices in Kerala. This is general background, not a list of BERRY9 clients.
Show details for Kochi businesses and the tests that suit them
Infopark and the city's technology firms
Software product and IT services companies sell to customers whose security teams send long questionnaires and expect an independent test of the product before a contract renews. For a web product, that test means signing in as each role and each customer account and trying to cross the lines between them.
Hospitals, clinics and diagnostics
A hospital runs its patient records, lab and imaging results, pharmacy and billing on an internal network that many people and devices share. An internal test, started from an ordinary staff login, shows how far someone could get from a ward computer or a visitor's foothold toward those records.
Seafood and spice exporters
Exporters keep traceability records for each lot, from the farm or the boat to the processing unit, and file certificates, invoices and packing lists through export-document portals and buyers' systems. A test checks that one buyer or agent sees only its own lots and documents, and that the APIs feeding those portals cannot be used to alter a record after it is signed off.
Tourism and hospitality booking
Hotels, resorts, houseboat and tour operators and the platforms that sell their rooms take guest identity details and payments online, and many run guest Wi-Fi beside the network the front desk uses. Booking flows are tested for price tampering and access to other guests' records; the Wi-Fi is tested on-site for a route from the guest network to staff systems.
Banks and NBFCs with Kerala head offices
Lenders, gold-loan companies and banks serve customers through mobile apps and net banking, including customers who live and work in the Gulf. The app on the phone, the API behind it and the branch network each carry money and identity data, and a regulated lender also has its vendors to answer for.
Tests that often come next
Once the first test is done, the follow-up is often Active Directory testing for a hospital or bank domain, a cloud security assessment for a product hosted on AWS, Azure or GCP, or a source code review before a major release.
The full list of what we test, with a page for each service, is on offensive security services.
04 / Before you sign
What you can check before you sign
A firm from out of town has to earn trust with something you can read. We do not publish client names or client results, so what we put in front of you is how we test and exactly what you receive at the end.
Show details for What you can check before you sign
The method in full
All of our work follows one five-phase method, which opens with the rules and the scope and closes with the report. See the methodology and judge the approach before anyone asks you for a purchase order.
The shape of the deliverable
The deliverable has three parts: the summary for management, the finding pages for engineers and the remediation matrix. See the sample report for the layout; the booking finding at the head of this page is drawn in the same format.
What every engagement hands over:
- An executive report in plain language for owners, boards, auditors and the customer or bank that asked for the test.
- An engineering report in which each finding carries a working proof of concept, a severity scored with CVSS 3.1 and the recommended fix.
- A remediation matrix that lists every finding with its severity and its state, open or closed.
- A readout call where the people fixing the findings can question them.
BERRY9 holds ISO/IEC 27001:2022 certificate 26MEQVU27. The certificate covers how we run our own security, not your organization.
05 / Compliance
Data protection, card payments and lender rules
For many Kochi organizations the reason to test arrives from outside: the DPDP Act for anyone holding personal data, PCI DSS for booking and payment pages, RBI's expectations for Kerala's banks and NBFCs and their vendors, and the security terms of clients abroad. Here is where a penetration test fits in each.
Show details for Data protection, card payments and lender rules
DPDP Act
Patient files, guest passport and ID copies, borrower documents and customer lists all count as personal data in the sense of the Digital Personal Data Protection Act, and the Act asks the business responsible for such data to protect it with reasonable security safeguards. A test shows where that data can be reached and leaves a dated record that someone looked.
PCI DSS
How much of PCI DSS reaches a booking site depends on how it takes cards, and the way the business validates compliance, through a QSA assessment or a self-assessment questionnaire, decides whether requirement 11.4 applies. A payment page hosted by the gateway leaves far less in scope than a card form on your own server; where 11.4 does apply, it calls for penetration testing from inside and outside the network every 12 months and after any significant change.
RBI-regulated lenders
RBI's directions on IT governance and outsourcing expect banks and NBFCs to test their systems and to oversee the vendors they rely on, and that expectation can reach a software or collections partner of a Kerala lender through its contract. BERRY9 is not CERT-In empanelled. A CERT-In empanelled auditor becomes necessary when a regulator, tender or contract requires one, and we say so at scoping.
Overseas clients
Technology firms that work for clients abroad meet ISO 27001, where test findings feed the vulnerability management an ISMS needs, and SOC 2. SOC 2 does not require a penetration test. Its criteria ask for controls that find and manage vulnerabilities, penetration testing is one common way to show that, and your auditor decides what evidence is enough. Healthcare software firms with American clients also hear about HIPAA through their contracts.
A test report is evidence for these frameworks, never a certificate. BERRY9 runs the test and writes the report; certifying or auditing your organization is left to your auditor, assessor or regulator.
06 / Engagement
From the first call to closed findings
Because the testing is remote, the meetings around it are usually online too. These are the steps, in order, and what each one needs from your side.
Show details for From the first call to closed findings
First
Scoping call
A call with whoever owns the systems: what is to be tested, which environment, who asked for the test and by when. If the request came from a bank, a client or a regulator, bring its wording; it decides what the report has to show.
Before testing
Written proposal and rules
The proposal sets the scope, the price, the dates and any days in Kochi. Signed rules of engagement then fix the assets, the testing windows, the emergency contacts on both sides and the systems that are off limits.
Access
Accounts and connections
Test accounts for each role, a signed app build where a mobile app is in scope, and the VPN login or jump host for internal work. Testing begins once these are in place.
Testing
Testing and reports
Testing and both reports fit into 5 to 10 working days after kickoff for a typical scope. A large estate, such as several hospital blocks or a group of apps on one backend, runs past that, and the proposal sets its dates.
Afterward
Readout and fixes
A readout call goes through each finding with the engineers who will fix it, and the remediation matrix becomes the list your team works through until every item is marked closed.
07 / Other cities
Other cities and the regional pages
Each of these cities is served the way Kochi is. The work runs from Hyderabad, internal tests go through access you provide, and a visit happens only where the work needs one.
Show details for Other cities and the regional pages
- VAPT services in Hyderabad
- VAPT services in Bangalore
- VAPT services in Chennai
- VAPT services in Coimbatore
- VAPT services in Visakhapatnam
- VAPT services in Vijayawada
Thiruvananthapuram, Kozhikode, Thrissur and the rest of Kerala are served on the same terms as Kochi, even without a page of their own. For the regional and national picture, see penetration testing across South India and VAPT services for companies across India, and to reach us another way, use the contact page.
08 / Inquiry
Tell us what needs testing
Send what is in scope, who asked for the test, whether Wi-Fi or a site without remote access is involved, and the date the report is due. We then agree the scope and the timeline on a short scoping call.
To talk it through first, call +91 86868 92922 or write to contact@berry9.com.
09 / FAQ
Frequently asked questions
Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.
Does BERRY9 have a team in Kochi or anywhere in Kerala?
No. BERRY9 has no office in Kochi; its one office is in Yellareddyguda, Hyderabad. Testing for Kochi clients is run from Hyderabad, and visits are made by arrangement. To talk about a scope, call +91 86868 92922, or send the details to contact@berry9.com.
Can a Kochi company get VAPT done without anyone traveling?
Usually, yes. Websites, booking engines, mobile apps, APIs and public IP addresses can all be reached from Hyderabad across the internet. Internal networks and Windows domains are tested over a VPN connection or from a jump host that your team prepares. Travel is needed only for Wi-Fi and for networks with no remote path. See the section on An out-of-town tester, stated plainly above.
When does an engineer need to come to Kochi?
When a wireless network is in scope, because the tester has to stand inside radio range of the access points, or when an internal network cannot be opened remotely and a testing laptop has to be placed on it. Any visit is agreed during scoping and written into the proposal before work starts.
How much does VAPT cost for a small Kochi business such as a hotel or clinic?
The starter scope, which starts from INR 9,000 + 18% GST, covers 3 to 5 external IP addresses and also fits a hotel's or clinic's simple WordPress site. A booking engine with guest logins, a patient app or anything with roles and an API starts from INR 27,000 + 18% GST. Your own figure is settled in writing after scoping. See the section on What VAPT costs for a Kochi business above.
Can we see a sample report before hiring you?
Yes. Before signing, read the BERRY9 sample VAPT report and methodology on our website, and raise anything your auditor or customer needs to see in the format during scoping. See the section on What you can check before you sign above.
Do you test hotel, travel and tour booking platforms?
Yes. The website, the app and the API behind a booking platform are tested for the things that matter to a booking business: reading or changing another guest's booking, paying less than the price shown, holding rooms without paying, and reaching the admin tools that set rates and availability.
Can you test a hospital's internal network?
Yes. The test starts from an ordinary staff login, either through a VPN or jump host or from a laptop placed on the network on-site, and looks for routes to patient records, lab and imaging systems and billing. Testing windows and the systems clinical staff depend on are agreed in writing before any testing starts.
What if a bank or regulator requires a CERT-In empanelled auditor?
In that case the work belongs with an auditor that CERT-In has listed, and BERRY9 is not CERT-In empanelled. Tell us at scoping who asked for the test and what the request says, so that this is settled before any work is agreed.
How soon after kickoff do we receive the report?
Typically 5 to 10 working days after kickoff, with both reports delivered at the end of that window. Bigger estates, such as several apps on one backend or a hospital with several blocks, take longer, and the proposal states how long.