VAPT Services in Mumbai: Find a CERT-In Empanelled Provider

Most VAPT reports I have reviewed in Mumbai were sold as penetration tests and delivered as vulnerability scans. There is a difference, and it is not academic. A scan runs a tool, prints a list of CVEs, and calls it a day. A penetration test has a human being who chains three medium-severity findings into a full account takeover, then writes down exactly how they did it so your engineers can reproduce and fix it. One costs a fraction of the other. Guess which one most buyers actually pay for without realising.

If you are procuring VAPT (Vulnerability Assessment and Penetration Testing) for a business in Mumbai — a fintech in BKC, a broker in Fort, a manufacturer in MIDC, a hospital in Andheri — the hard part is not finding a vendor. There are hundreds. The hard part is telling the ones who will actually break into your systems from the ones who will email you a Nessus PDF with your logo on the cover. This piece is about how to tell them apart, what a real engagement costs and how long it takes, and what a defensible report has to contain.

CERT-In (the Indian Computer Emergency Response Team, under MeitY) maintains a list of empanelled security auditing organisations. When people say they want a CERT-In empanelled VAPT provider, they usually mean one of two things, and it matters which.

The first is a compliance driver. If you are a regulated entity — a bank or NBFC under RBI, a stockbroker or depository participant under SEBI, an insurer under IRDAI, a payment aggregator under the RBI PA-PG guidelines — your auditor and, increasingly, your VAPT provider are expected to be CERT-In empanelled. Post the CERT-In Directions of April 2022, any organisation that suffers a reportable incident must notify CERT-In within six hours, and the forensic and audit trail you produce afterwards is judged against empanelled-grade work. If your VAPT was done by an unlisted vendor, a regulator can and does question its weight.

The second is a quality signal. Empanelment is not a rubber stamp — the organisation has to demonstrate methodology, qualified staff and process. But here is the part vendors will not tell you: empanelment sits with the organisation, not the individual tester who shows up on your engagement. An empanelled firm can still put a fresh graduate on your job. So empanelment is a necessary filter to get onto your shortlist. It is not sufficient. You still have to interrogate who does the actual testing and how.

This is where most Mumbai procurement goes wrong, so let me be blunt about the two halves of VAPT.

A vulnerability assessment (the VA) is breadth. Authenticated and unauthenticated scans across your estate, a version-and-configuration audit, findings mapped to CVEs and CVSS scores. It is largely tool-driven, it is fast, and it is cheap. It answers the question what is potentially wrong.

A penetration test (the PT) is depth. A human tester takes the findings and tries to actually exploit them — chaining a verbose error message into an SQL injection, an injection into database access, database access into cracked password hashes, and cracked hashes into a working login on your admin panel. It answers the question what can an attacker actually do, and how far can they get. This is manual, slow and expensive, and it is the part that finds the business-logic flaws no scanner will ever catch — the coupon that stacks infinitely, the account ID you can increment in the URL to read someone else's KYC (identity verification) documents, the OTP (one-time password) you can bypass by replaying a stale token.

Ask any vendor to show you a sample report and go straight to the findings. If every finding reads Detected by scanner, Confirm and patch, you are buying a VA dressed as VAPT. If findings read Step 1 through Step 6 with request/response evidence and a proof-of-concept, that is a real PT.

A test is only as good as its scope, and a rushed scope is the single most common reason a VAPT gives false comfort. Before anyone touches a keyboard, a competent provider will pin down exactly what is in and out.

For a Mumbai fintech carrying customer PAN, Aadhaar-linked KYC and bank details, that last point is not paperwork. Under the DPDP Act 2023, your VAPT provider is effectively a data processor the moment their report contains a screenshot of a real customer record. Put the data-handling and deletion terms in the contract, not the kickoff call.

Vendors dodge this question, so here are honest ranges from the Indian market as of 2026. Prices vary with complexity, number of user roles, API surface and whether you need a formal re-test, but these are the brackets you should expect. Treat anything dramatically below the floor as a scan, not a test.

Two things buyers underestimate. First, the re-test. A finding is not closed until someone verifies your fix, and a report without a re-test cycle leaves you asserting closure to a regulator on faith. Insist that one round of re-testing is included in the price. Second, the report and debrief. Half the value of a good PT is the walkthrough call where the tester explains the attack chain to your engineers. If a vendor quotes suspiciously low, they have usually cut the manual depth, the re-test, or the debrief — often all three.

A payments company in Lower Parel hired us after a cheaper vendor had given them a clean external network report three months earlier. Their board wanted comfort before a funding round. We ran a grey-box test on the customer web app with two low-privilege merchant accounts.

The scanner found nothing exciting — some missing security headers, an outdated library. The interesting part came by hand. A transaction-history endpoint took a merchant ID in the URL. We changed the digits to a neighbouring value and it returned another merchant's settlement records — full transaction amounts, settlement bank accounts, contact details. An insecure direct object reference, textbook, and completely invisible to a scanner because every request was technically valid. We then found the same pattern on the refund endpoint, which meant a hostile merchant could trigger refunds against transactions that were not theirs.

None of that appeared in the earlier clean report because that vendor had run a tool and never logged in as a real user with real intent. The board did not need a longer CVE list. They needed one person who would think like an attacker who wanted their money. That is the entire difference between a scan and a penetration test, and it is why the badge on the cover matters less than the mind behind the keyboard.

When a regulator, a customer's security team or an acquirer reviews your VAPT, they are reading the report — not watching the test. A report that cannot stand on its own is worthless no matter how good the testing was. Judge every provider by their sample report against this list.

One more test. Severity ratings should reflect your context, not a generic score. A cross-site scripting flaw on a static marketing page and the same flaw on your logged-in banking dashboard are not the same risk, and a good report says so. If every finding is rated straight off the CVSS calculator with no business context, the tester was not really thinking about your business.

Once you have a shortlist of CERT-In empanelled firms, this is the checklist I would run before signing anything. It weeds out the scan-sellers fast.

For regulated Mumbai entities, sequence it right. Do your VAPT well ahead of your annual RBI or SEBI examination and re-audit windows, so you have time to remediate and re-test before the regulator arrives — not the week before, when a critical finding turns into a fire drill.

The report that says everything is fine is the one to distrust. Real penetration testing produces uncomfortable findings, because a real attacker would find them too — the point is to find them first, on your terms, with a paper trail. In a city with as many vendors as Mumbai, the badge gets a firm onto your shortlist. The mind behind the keyboard, the depth of the manual work and the honesty of the report decide whether the money was well spent.

At CyberSigma we are CERT-In empanelled and we do this hands-on — senior testers who sit in the audit room, chain the findings by hand and write reports that hold up in front of RBI, SEBI and your toughest enterprise customer. If you want a scoping conversation before your next examination window, we are happy to have it.