Security services · Testing

Penetration testing & VAPT.

We attack your applications and infrastructure the way real adversaries would, prove what an attacker could actually reach, and show you exactly how to close each gap. Then we test again, free.

Get a fixed-price quote
Manual testing, not just a scanCVSS-scored, ranked fixesFree retest of fixed findings
pentest · sample● demo
  1. FOUND Broken access control on /api/invoices
  2. FOUND Admin panel reachable with default password
  3. FLAGGED Outdated library with a public exploit
  4. FIXED Rate limiting added to login
  5. PASSED No SQL injection in search
In plain words

Penetration testing, usually called VAPT (vulnerability assessment and penetration testing) in India, is a controlled attack on your systems by security testers. We combine automated scanning with manual testing to find, prove and rank weaknesses in web apps, APIs, mobile apps, networks, cloud and Wi-Fi, then give you exact fixes and retest them free.

Duration
1–4 weeks
Method
PTES · OWASP WSTG, ASVS, MASTG
Scoring
CVSS and EPSS
Pricing
Fixed fee
What we test

Every way in, tested by hand.

  • Web applications

    OWASP Top 10, broken access control and the business-logic flaws scanners miss.

  • APIs

    REST and GraphQL, tested against the OWASP API Security Top 10.

  • Mobile apps

    iOS and Android apps and their back ends, following OWASP MASTG.

  • External network

    Everything you expose to the internet: servers, VPNs, mail, forgotten hosts.

  • Internal network and Active Directory

    What an attacker could reach after one laptop is compromised.

  • Cloud configuration

    AWS, Azure and Google Cloud set-up, identity and storage.

  • Wi-Fi and physical

    Wireless networks and, if you want it, building access.

  • Secure code review

    A person reading the riskiest parts of your code: sign-in, payments, data access.

  • AI features

    Chatbots and AI tools inside your app, tested with our AI red team.

AI features get the full AI attack set from our LLM red team, not just a web test.

Know what you are buying

A scan is not a penetration test.

Both have their place. Only one tells you what an attacker could really do.

Vulnerability scan

Automated, fast, good for regular hygiene.

  • Finds known issues across many systems
  • Many false alarms to sort through
  • Cannot chain small issues into a real attack
  • Blind to business-logic flaws
  • Does not prove what data is at risk

Penetration test

Automated breadth plus manual depth.

  • Every finding proven, false alarms removed
  • Small issues chained into real attack paths
  • Logic flaws such as paying ₹1 or seeing another user’s data
  • Business impact explained in plain words
  • Free retest of everything you fix
How it works

Five steps, agreed in writing.

  1. Week 0

    Scoping and rules of engagement

    Targets, test windows, contacts and what is off limits, signed before any testing starts.

  2. Days 1–2

    Reconnaissance

    We map what an outsider can see: domains, hosts, apps, people and technology.

  3. Days 2–12

    Testing

    Automated scanning for breadth, then manual exploitation for depth, all logged.

  4. End of testing

    Reporting

    Leaders’ summary and a technical report with proof, CVSS scores and fixes, walked through on a call.

  5. After your fixes

    Retest

    We confirm each fix works and update the report.

Black, grey or white box? Black-box tests start with nothing, like an outsider. Grey-box tests use a normal user account. White-box tests include code and design. Grey-box usually gives the most value per day.
What you get

A report your auditors, board and developers can use.

HANULSECPenetration test report CLIENTSample · B2B SaaS platform SUMMARY FOR LEADERS FINDINGS BY SEVERITYCritical1High4Medium7Low6 COVERAGE · OWASP WSTG · ASVS RETEST PASSED Sample layout, not client data
  • 01
    Executive summary

    What we found, what it could cost and what to fix first, in plain English.

  • 02
    Technical report

    Every finding with evidence, steps to reproduce, CVSS score and a fix.

  • 03
    Prioritised fix list

    Ranked by real exploit risk, not just severity scores.

  • 04
    Free retest

    Every fixed finding checked, and the report updated.

  • 05
    Attestation letter

    A short letter for customers and auditors confirming the test and retest.

When you need one

The moments that call for a pentest.

  • Before a big launch, or before an enterprise customer’s security questionnaire
  • At least once a year, and after major changes to apps or infrastructure
  • When preparing for ISO 27001, SOC 2 or PCI DSS
  • Banks, NBFCs, fintechs and market entities that regulators expect to test regularly
  • After a merger or acquisition, to see what you inherited

A note on CERT-In empanelment

HanulSec is not a CERT-In empanelled auditor. Some organisations, for example certain SEBI-regulated entities and government bodies, must get specific audit reports from an empanelled auditor.

Our testing is the right choice for finding and fixing problems, for customer and ISO or SOC 2 evidence, and for getting ready so your official audit goes smoothly. See CERT-In rules explained.

Methods

Built on public, proven methods.

OWASP testing guidesWeb, API and mobile
PTESTesting method
CVSS and EPSSSeverity and exploit odds
PCI DSS v4.0Card data security
ISO/IEC 27001Information security
CERT-InDirections and audit guidelines

Emblems are HanulSec’s own artwork showing which frameworks our work maps to. They are not the owners’ logos and do not mean HanulSec is certified against them.

Questions

Questions buyers ask before they call us.

Q01What is VAPT?
VAPT stands for vulnerability assessment and penetration testing. The vulnerability assessment finds weaknesses, mostly with tools. The penetration test proves which ones an attacker could actually use, and how far they could get. In India the two are usually bought together.
Q02How much does a penetration test cost in India?
We quote a fixed fee after a free scoping call. The price depends on the number and size of apps, APIs and networks, the type of test (black, grey or white box), whether mobile or cloud is included and your deadline. We never charge by the number of findings.
Q03How long does it take?
One to four weeks of testing, depending on scope. A single web app with an API usually takes one to two weeks.
Q04Is testing safe for our live systems?
We agree test windows, avoid destructive actions, rate-limit our tools and stay in touch throughout. Where possible we test a staging copy. If anything looks unstable, we stop at once.
Q05How often should we test?
At least once a year and after any major change, such as a new app, a big release, a cloud migration or an acquisition. Regulated firms often need more frequent testing.
Q06Are you CERT-In empanelled?
No. If a regulator specifically requires a report from a CERT-In empanelled auditor, that report must come from one. Our testing helps you find and fix issues before that audit, and serves as evidence for customers, ISO 27001 and SOC 2.
Q07What do we get at the end?
An executive summary, a technical report with evidence and fixes, a free retest and an attestation letter you can share with customers.
Next hops

Related services

Request a quote

Scope it in two minutes.

Tell us what you need protected. A security engineer, not a salesperson, replies with a fixed-price proposal.

Start your quote hello@hanulsec.com
  • Reply within one business day
  • Free 30-minute scoping call
  • Mutual NDA before any detail is shared
  • Fixed price, free retest of fixed findings