Penetration Testing in Bengaluru

What counts as one scope

One scope is one application or one interface. A single web application is one scope. The API behind it is a second scope, because it is a separate attack surface with its own authorization model and its own set of consumers, and testing the web UI does not test it. An Android build and an iOS build are two scopes for the same reason: different local storage, different runtime protections, different platform behaviour. One cloud account is one scope. One IoT device family is one scope. This is why so many SaaS engagements land on two scopes, and why the Growth Pentest includes two as its base.

What raises the price

• More scopes. This is the only lever in our pricing. A second scope on the Startup plan is INR 44,999 and adds 5 business days. On Growth, scopes beyond the base two are INR 74,999 each, and from the third onward they run in parallel up to 3 at a time, adding 5 business days per parallel batch. A 3 or 4 scope engagement therefore completes in 15 business days rather than stretching to a month.
• Scale that breaks the fixed-price assumption. Internal network estates beyond one Active Directory domain, or engagements of 5 or more scopes, move to a custom scoping proposal. We would rather quote a timeline we can staff than take a fixed fee and cut testing depth to fit it.
• Work that is not a pentest. Red team simulation, social engineering, and physical assessment are separate engagements with separate authorization. They are not silently folded into a pentest quote.

What does not raise the price

• Finding a lot. The fee is the same whether we find 3 issues or 30. Any pricing model that varies with finding count creates an incentive nobody should want on either side of the table.
• The retest. One full retest is included in both plans, covering every original finding rather than a sample.
• Questions during and after the engagement. Startup includes 6 hours of founder-led consulting usable for 6 months from kickoff, Growth includes 12 hours usable for 12 months. Remediation pairing, an architecture question the test raised, or help answering a customer security questionnaire all come out of those hours.
• Reasonable clarification of the target. If scoping reveals the application is materially larger than described, we tell you before testing starts and agree a change in writing. We do not discover it mid-engagement and invoice for it afterwards.

What to give us so the test is worth paying for

Almost all of the difference between a shallow test and a useful one is decided before day one, and most of it is on your side:

• Test accounts for every role. At minimum two accounts in two different tenants, plus one account per privilege level. Without these, the entire authorization class of findings cannot be tested, and that class contains the issues that hurt most.
• A staging environment that matches production. Same code, same authorization model, representative data shape. Where it diverges, tell us, and the divergence is recorded as a scope limitation in the report rather than quietly ignored.
• API documentation if it exists, and no panic if it does not. A collection export or an OpenAPI spec saves reconnaissance time that gets spent on testing instead. We test undocumented APIs regularly; documentation simply buys you more depth for the same fee.
• Allowlisting for your WAF and rate limiter. Otherwise a meaningful part of the engagement is spent measuring your WAF rather than your application.

If you want to work through this before talking to anyone, our guide on how to scope your first penetration test covers the same ground vendor-neutrally.

A pentest report has two readers with opposite needs. Your CEO, your auditor, and your prospective customer need the risk picture in a page. Your engineers need enough detail to reproduce and fix each issue without a follow-up call. A report that serves only one of them fails the other, which is how firms end up shipping either a 200 page scanner dump or a two page summary nobody can act on.

Growth Pentest reports add a compliance evidence package mapping each finding to the SOC 2 and ISO 27001 control it evidences. Startup Pentest reports are structurally identical but omit that mapping. Both include the retest section that records the v1.0 to v2.0 remediation trail, which is usually the part an auditor or a diligence team reads most closely.

Behind the founders there is a named delivery bench rather than an anonymous pool. Abhinay owns pentest delivery. Theertha leads the team that runs L1 work during a test and owns retesting as its main line. You will know who is in your application before testing starts, and the report names its lead assessors.

At team level our certifications include CISSP, CEH, CREST, ISO 27001 Lead Auditor, and CompTIA PenTest+. We attribute those to the team because that is what they are. The OSCP and the M.Sc belong to Rathnakara individually, and we do not pluralise them into a claim about everyone here. If a vendor talks about "our OSCPs" without naming them, ask for the names.

DPDP Act 2023: reasonable security safeguards

Section 8(5) of the Digital Personal Data Protection Act 2023 requires every Data Fiduciary to take reasonable security safeguards to prevent a personal data breach. The Act does not define "reasonable" in technical detail and does not mention pentesting. In practice, the industry standards auditors and regulators fall back on, ISO 27001, SOC 2, and OWASP, all treat application security testing as a core component, which is why a current pentest report plus a remediation trail is the simplest defensible artifact to hold. The penalty for failure to take reasonable security safeguards resulting in a breach runs up to INR 250 crore. Note what that means practically: the report alone is not the evidence, the report plus proof you fixed what it found is.

CERT-In: 6 hours from detection

The CERT-In Directions of 28 April 2022, issued under Section 70B of the IT Act 2000, require cyber incidents listed in their Annexure I to be reported to CERT-In within 6 hours of noticing them. The word doing the work is "noticing". The clock starts at detection, not at occurrence and not when your investigation concludes. This is why a pentest and an incident response plan are complementary rather than interchangeable: the pentest tells you what an attacker could do, and the plan is what lets you meet a 6 hour deadline without an emergency legal review. We cover the mechanics in detail in our guide to the CERT-In 6-hour rule. One honest clarification, since this claim is made loosely in this market: CERT-In empanelment is a separate designation. We do not hold it and we do not claim it. It is required only if your sector or your customer independently demands an empanelled auditor, and for most SaaS pentests it does not.

Enterprise security questionnaires

Not a regulation, but for most Bengaluru SaaS companies this is the obligation that actually forces the purchase. A large Indian bank, an enterprise buyer, or an international customer sends a vendor security questionnaire, and somewhere in it is a question asking for evidence of independent application security testing within the last 12 months. Read the question carefully before scoping, because it usually names the systems it cares about. Scope the pentest to what the questionnaire names. Buying a test of the wrong surface is the most expensive scoping mistake we see.

Is the spend proportionate?

A fair question to ask any vendor, so here is the comparison using published figures rather than our own arithmetic. the IBM Cost of a Data Breach Report 2026 puts the average breach cost in India at INR 25.5 crore, an all-time high and a 15.9 percent rise on the INR 22 crore recorded for 2025. That is an all-sector average, not a SaaS-specific figure, and averages hide enormous variance.

The caveat matters more than the ratio, and you should apply it to anyone quoting these numbers at you, ourselves included: this compares a certain cost against an uncertain event, and no pentest removes breach risk. What a pentest reliably does is find the classes of flaw that scanners miss before someone else finds them, and produce evidence a buyer, an auditor, or an investor will accept. Treat the comparison as a sense of proportion, not a return on investment calculation.

Related reading: DPDP Act pentest requirements for Indian SaaS and penetration testing cost in India in 2026.