Top 7 VAPT Companies in India in 2026 and How to Evaluate Them [Updated]

Most lists of VAPT companies in India read the same. Every firm promises manual testing, certified experts, and detailed reports. The actual differences sit elsewhere: whether a firm is on CERT-In’s current empanelled list, how much of its testing is manual, and whether retesting is in the contract. The seven firms below were chosen with those checks in mind.

Every VAPT company in India on this list appears on CERT-In’s list of empanelled information security auditing organisations, as published on October 22, 2026. Facts about each firm come from the snapshot it filed with CERT-In, or from its own public description of its services.

Best 7 VAPT Companies in India: A Comparative Analysis

All seven VAPT companies in India in this list are on CERT-In’s empanelled list. The headquarters city comes from that list. The year each firm began information security audits comes from its own CERT-In snapshot. The last column shows what sets each firm apart, and that tells you more about fit than any ranking could.

1. Kratikal

Kratikal is headquartered in Noida, with offices in Pune, Mumbai, and Bengaluru, and a presence in the USA and the Middle East. It has been CERT-In empanelled since 2021, and its snapshot dates its audit work to 2013. More than 1875+ Enterprises and SMBs clients trust Kratikal with their security.

Testers exploit findings by hand. Between engagements, coverage continues on AutoSecT, Kratikal’s AI-driven pentest and vulnerability management platform, launched in 2023. AutoSecT ensures appsec (web apps, mobile apps, APIs), cloud environment security (AWS, Azure, and GCP), and internal and external network security.

Every finding is retested after your developers patch it, so the report you close is verified, not assumed. Kratikal also runs RBI, SEBI, and IRDAI audits, which helps when a pentest report has to double as compliance evidence.

2. Payatu

Payatu is a CERT-In empanelled firm based in Pune. Its snapshot dates its audit practice to 2011 and lists subsidiaries in the US, Australia, Singapore, and the UAE.

According to the company, its team founded the nullcon and hardwear.io security conferences. Payatu’s strength is depth in hardware, firmware, IoT, and embedded devices, alongside application and cloud testing. If your product is a connected device, Payatu is the most natural fit on this list.

3. eSec Forte Technologies

eSec Forte Technologies is a CERT-In empanelled firm based in Gurugram. Its snapshot dates its audit practice to 2011 and lists offices in Singapore, Sri Lanka, and the USA.

The same snapshot shows something buyers should know. eSec Forte also works as a value-added partner for several security product vendors, handling pre-sales and implementation. For some buyers, that is a convenience, with testing and tooling from one supplier.

4. Suma Soft

Suma Soft is a Pune-based IT services company with a security practice. According to its CERT-In snapshot, filed in August 2026, it has carried out information security audits since 2008. The snapshot also notes channel partnerships with security product companies from the USA and Israel.

Suma Soft suits organisations that already buy IT services from one provider and want VAPT handled inside that relationship. Because the wider services portfolio is large, confirm the size of the team that actually does the testing.

5. WeSecureApp

WeSecureApp is listed by CERT-In under its legal entity, Tek Cube Pvt. Ltd., in Hyderabad, with audit work dating to 2015. Its October 2025 snapshot names Strobes Security Inc., based in Texas, as its parent company. The Strobes platform also appears in its list of testing tools.

In practice, buyers get an Indian empanelled entity backed by a US parent’s vulnerability management platform. That suits companies that want test results to flow straight into ongoing exposure management.

6. Astra Security

Astra Security appears on CERT-In’s panel under its legal name, Czar Securities Pvt. Ltd., with a Chandigarh address. Its snapshot dates its audit work to 2018 and records it as a subsidiary of a Delaware-registered parent. Astra markets a platform-led model: an automated vulnerability scanner paired with manual penetration testing. Startups and SaaS teams that want their findings on a dashboard tend to suit that model.

7. SISA

SISA Information Security is a CERT-In empanelled firm headquartered in Bengaluru, and it has the longest audit history of the seven. Its snapshot dates its information security audits to 2006.

The same snapshot shows a heavy share of payment card industry work, and offices across the Americas, the Middle East, Europe, and Asia Pacific. SISA describes its approach as forensics-driven. Its typical buyers are payment processors, card issuers, and multinationals running operations across several regions.

What a VAPT Company in India Should Deliver?

A VAPT company in India should deliver two activities and one closing step. Vulnerability assessment is the broad part. It inventories your applications, APIs, networks, and cloud accounts, and finds known weaknesses across all of them. Penetration testing is the deep part. A tester tries to exploit those weaknesses, chains them together, and shows what an attacker could actually reach.

The closing step is a retest that confirms each fix worked. For a fuller explanation of both halves, see this guide to VAPT testing.

The difference shows up when you compare quotes. Some vendors sell “VAPT” but deliver only the assessment half. You get a long list of findings ranked by a generic severity score, and no evidence of which ones an attacker can use. Other vendors skip the retest. That leaves your own team to judge its fixes, which is the one job an external tester exists to take off your hands.

Every Indian VAPT engagement should produce these deliverables:

• A written scope listing every asset, environment, and test type, agreed before testing starts
• A technical report with a proof of concept for each exploitable finding
• An executive summary a board or IT committee can approve
• A retest or revalidation report confirming which findings are closed
• For regulated entities, a report in the format the regulator or CERT-In prescribes

There is also a plain business case. According to IBM’s 2025 India findings from its Cost of a Data Breach Report, vulnerability exploitation accounted for 13% of breach initial attack vectors in India. Third-party vendor and supply chain compromise came in at 17%.

That second number matters here. The firm you hire to test your systems will see your architecture, your credentials, and your weak points. Choosing that firm is a security decision in its own right.

When Indian Regulators Require a CERT-In Empanelled Auditor?

Indian regulators do not all ask for the same thing. The difference decides whether CERT-In empanelment is a legal requirement for you or simply a preference. Three frameworks cover most regulated buyers.

1. SEBI

SEBI’s Cybersecurity and Cyber Resilience Framework (CSCRF), issued in circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113 on 20 August 2024, requires regulated entities to run VAPT through CERT-In empanelled auditing organisations.

Findings must be closed within 3 months of the VAPT report’s submission, and the auditor revalidates the closure. This breakdown of SEBI’s VAPT guidelines covers the categories and timelines.

2. RBI

Clause 26 of the RBI’s IT Master Direction, dated 7 November 2023, sets a clear cadence for critical systems and customer-facing systems in the DMZ: vulnerability assessment at least every 6 months, and penetration testing at least every 12 months.

Note what the clause does not say. It asks for “appropriately trained and independent” experts and never names CERT-In empanelment. Most banks and NBFCs still choose an empanelled firm, so that one report satisfies both RBI and CERT-In expectations. This RBI audit checklist for banks and NBFCs maps the wider audit requirements.

3. CERT-In itself

CERT-In’s Comprehensive Cyber Security Audit Policy Guidelines (version 1.0, 25 July 2025) set a baseline of at least one cyber security audit a year. Sectoral regulators can raise that frequency. Insurers, for example, follow their own cadence under IRDAI, summarised in this overview of IRDAI’s 2026 cybersecurity guidelines.

If none of these regulators covers you, empanelment is still useful evidence that a firm has been vetted. It should not be your only filter, though. Plenty of strong testers are not empanelled, and empanelment says nothing about how deep a particular engagement will go.

How to Verify a CERT-In Empanelled VAPT Company

The only reliable way to verify a CERT-In empanelled VAPT company is to find its legal entity name on CERT-In’s own published list. The vendor’s website does not count. The CERT-In empanelled list is a PDF on cert-in.org.in, and the version dated 22 October 2026 names 236 organisations.

The same PDF holds something most buyers never open: each firm’s snapshot. A snapshot is a self-declared profile the firm files with CERT-In. The 2025 audit guidelines tell organisations and regulators to use these snapshots to shortlist auditors, by matching their requirements to each firm’s competence. A snapshot shows:

• The year the firm started carrying out information security audits
• The number of audits it completed in the previous 12 months
• Its count of technical personnel and their certifications
• Whether it outsources audit work to external experts
• Its foreign tie-ups, parent companies, and overseas offices
• The date the snapshot was filed, which tells you how current the rest is

Two wording checks catch most false claims. Under CERT-In’s guidelines, an empanelled firm may describe itself with one sanctioned sentence about being empanelled for information security auditing. Any other description of the relationship needs CERT-In’s written permission.

So there is no such thing as a “CERT-In certified” or “CERT-In approved” company. When a vendor uses those phrases, read the rest of its proposal with extra care. For a wider view of empanelled firms, see this list of CERT-In empanelled auditors.

How to Evaluate a VAPT Company in India: 6 Criteria

Evaluating a VAPT company means looking past the brochure. Almost every provider claims manual testing, expert teams, and detailed reports, so those claims do not separate anyone. The six criteria below do produce different answers from different vendors, and most of them trace back to a specific clause in CERT-In’s 2025 audit guidelines.

1. Empanelment That Matches Your Regulator

Start with the rule that applies to you. A SEBI regulated entity must use a CERT-In empanelled auditor, so a non-empanelled firm is out before any other comparison begins. An RBI regulated entity needs independent, trained testers, and usually prefers empanelment for convenience. An unregulated SaaS company can treat empanelment as one signal among several. Whichever group you fall into, ask each vendor for the exact entity name to check on the CERT-In list.

2. Manual Exploitation, Not Scanner Output

CERT-In’s 2025 audit guidelines are direct on this point. Solely tool-based testing should be discouraged, because it overlooks the manual components of a system.

The practical test is simple: ask how many tester-days the quote includes, and what share of them is manual.

Picture two quotes for the same web application. One includes 4 tester-days, mostly scanning. The other includes 12, mostly manual. Those are not one product at two prices. They are two different products. Business logic flaws, broken access control, and chained exploits rarely show up in a scanner, and this comparison of automated and manual pentesting shows where each approach stops.

3. A Methodology Built on Full Standards

Limited lists such as the OWASP Top 10 and SANS Top 25 should not be treated as audit standards, according to the same CERT-In guidelines.

So ask which framework drives each test type. For web applications, the expected answer is OWASP’s testing guide, known as the WSTG, or the ASVS. For mobile, it is the OWASP Mobile Security Testing Guide. For cloud, it is a framework such as the CSA Cloud Controls Matrix. A proposal that promises “OWASP Top 10 coverage” and nothing more is describing a minimum, not a method.

4. Named Testers and No Subcontracting

Empanelled firms are barred from sub-letting or outsourcing audit assignments under CERT-In’s guidelines, which also tell auditees to verify the credentials of the people actually deployed.

Ask for the names, certifications, and experience of the testers on your engagement. Then check the “outsourcing” field in the firm’s snapshot. A vendor that cannot name its testers before signing is probably planning to staff the work after it wins the deal.

5. Retesting Included in the Price

Retesting is where many low quotes win back their margin. CERT-In’s 2025 guidelines say follow-up audits belong in the scope or RFP, and should run after you close the findings. SEBI’s CSCRF goes further, expecting closure within 3 months with revalidation.

Get three things in writing: how many retest rounds are included, how long the retest window stays open, and whether retests are priced separately. This explainer on remediation over reports shows why this step decides whether the engagement was worth the money.

6. Independence and Data Handling

Independence starts with money. Under CERT-In’s guidelines, an auditor’s fees should not depend on the audit outcome or on approval of closure reports, so walk away from any offer that ties payment to a “clean” result.

Data handling comes next. Audit data must stay on systems in India, sit encrypted on tester laptops, and be wiped once the project ends. The firm should then issue you a formal certificate confirming the deletion. Ask each vendor to describe its data handling process, and to confirm it will issue that certificate.

Questions to Ask a Pentest Provider Before Signing

Questions to ask a pentest provider work best as a scored comparison. Send the same list to every shortlisted vendor, then judge the written answers side by side. The VAPT vendor evaluation checklist below pairs each question with the answer that should worry you.

Question to ask	Good answer	Red flag
What is your exact legal entity name on CERT-In’s list?	A name you can find in CERT-In’s current PDF	“We are CERT-In certified”
How many tester-days does this quote include, and how many are manual?	A specific number with a manual majority	“Our platform runs thousands of checks”
Which standards drive web, mobile, API, and cloud testing?	WSTG, ASVS, MSTG, CSA CCM, named per test type	“OWASP Top 10 and SANS 25” only
Who will test our systems?	Named testers with certifications and experience	“Assigned after kickoff”
Do you subcontract any part of the work?	No, matching the snapshot’s outsourcing field	Hesitation, or a yes for empanelled audits
How many retest rounds are included, and for how long?	At least one retest, with a defined window	Retests quoted separately after the report
Can we see a redacted sample report?	A full sample with proofs of concept	A template with placeholder findings
Where is our data stored, and how is it deleted?	India-based storage, encryption, deletion certificate	No written process
Is any fee tied to a clean result or a closure report?	No	A discount for passing

Score each answer from 0 to 2. Drop any vendor that scores 0 on the first, fourth, or sixth question, because those three cover legitimacy, staffing, and remediation.

What Drives VAPT Cost in India?

VAPT cost in India depends mainly on scope and depth, not on the vendor’s brand. Take two web applications. One is a brochure site. The other has 15 user roles and a payment flow.

The same company can quote very different figures for each, and both quotes can be fair. Five factors explain most of the gap between quotes:

• Asset count and type: each web app, mobile app, API, and network segment is scoped separately
• Application complexity: user roles, workflows, and integrations drive the number of test cases
• Testing approach: black box, grey box, and white box testing need different effort, as this guide to box testing techniques explains
• Manual depth: tester-days are the largest single cost driver
• Retest rounds and regulatory reporting: SEBI, RBI, and CERT-In formats add documentation effort

When two quotes differ sharply, compare tester-days and retest terms before you compare price. A quote at half the price of the others usually buys a fraction of the manual testing, or leaves retests out. The surest way to make prices comparable is to give every vendor the same written scope document.

What a Good VAPT Report Should Contain

A good VAPT report proves exploitability. It does not just list possibilities. If a vendor offers a VAPT report sample during evaluation, check it for each of these elements before you look at the formatting:

• Executive summary that states business risk in plain terms for the board or IT committee
• Scope and methodology section naming the assets, dates, test types, standards, and tools used
• Severity ratings using a recognised model such as CVSS from FIRST, adjusted for your environment
• Proof of concept for every exploitable finding: requests, responses, screenshots, or reproduction steps
• Remediation guidance specific enough for a developer to act on without a follow-up call
• Retest status column showing which findings were verified as fixed

Be wary of a report that rates every finding “high” and gives no reproduction steps. A scanner probably wrote it.

Be equally wary of a vendor that offers a “VAPT certificate” before testing is complete. A genuine certificate or attestation summarises a finished engagement and its retest, and this explainer on getting a VAPT certificate covers what one should and should not mean.

Red Flags When Evaluating a VAPT Service Provider

Red flags in a VAPT service provider usually show up in the proposal, long before testing starts. One of them is a reason to ask harder questions. Two together are usually a reason to move on:

• A fixed price with no scoping call. A provider that quotes without asking about roles, workflows, or environments is pricing a scan, not a test.
• Turnaround measured in hours. Meaningful manual testing of a single complex application takes days.
• “CERT-In certified” or “CERT-In approved” in the marketing. Neither status exists.
• Results promised in advance. Guaranteeing a pass, or tying fees to closure, breaks CERT-In’s independence principle.
• No named testers. Staffing decided after signature often means junior or outsourced work.
• Retests sold separately after the report. Remediation verification belongs in the original contract.
• Products pushed in the findings. Recommendations that point mainly to tools the vendor resells deserve a second opinion.

An internal security team can catch some of these issues, but it cannot replace an outside view of your systems. This piece on external versus internal testing covers that trade-off.

Choosing Your VAPT Company in India

The right VAPT company in India can do four things. It can prove its empanelment on CERT-In’s own list. It can name the testers who will work on your systems. It can show you a report with real proofs of concept. And it will commit to retesting in the original contract. Put every shortlisted firm through the same questions, and let the written answers make the decision.

Comparing providers now? Kratikal can scope your applications, APIs, and infrastructure, and walk you through a redacted sample report before you commit. Start with its VAPT testing services, or with its CERT-In security audit team if a regulator is involved.

FAQs