Cybersecurity Consulting Services

Fractional security consulting gives your startup access to senior security expertise (AppSec, InfraSec, GRC) on a part-time basis, 2 to 8 hours per day, 22 working days per month, 3-month minimum. Like having a security team without the full-time headcount.

A pentest is a point-in-time offensive test. Security consulting is ongoing. We embed in your team to review code, harden infrastructure, build policies, and guide security decisions day-to-day.

The Cybersecify Security Retainer is INR 24,999 per month, recurring, with a 3-month minimum commitment. It includes 10 hours of founder-led consulting per month (security architecture review, vendor risk review, threat-model walkthroughs, incident playbook drafting, policy work, hands-on engineering pairing as needed), one monthly external attack surface scan report (continuous coverage of your internet-facing assets: DNS, subdomains, exposed services, certificate hygiene, leaked secrets), and one monthly Brand Protection scan (typosquatting domain detection, brand impersonation on social platforms and app stores, leaked credentials). Extra consulting hours beyond the included 10 are billed at a flat INR 2,500 per hour. International pricing: ~USD 300 per month / ~EUR 280 per month at snapshot FX. The Retainer is the recurring counterpart to the one-time pentest plans.

vCISO (Virtual CISO) is a relational engagement model where Cybersecify acts as your fractional Chief Information Security Officer: board reporting, security strategy, hiring guidance, vendor relationships, customer-facing security calls, audit committee attendance. vCISO is typically a 6 to 12 month engagement, custom-scoped per buyer (not a productized plan), and priced based on the time commitment and seniority required (typically INR 1,50,000 to INR 4,00,000 per month). The Security Retainer at INR 24,999 per month is the productized execution-focused subscription: hands-on architecture review, control implementation, policy drafting, monthly scans. Most SaaS startups under Series A start with the Retainer and graduate to vCISO when board-level security reporting becomes a requirement (typically at Series A diligence or first enterprise customer onboarding). The two engagements can overlap: a vCISO buyer often also takes the Retainer for the execution hours.

Compliance readiness is a common Retainer use-case. Cybersecify approach for each framework. DPDP Act: gap-map the 11 chapters of the Act against your current data-handling practices (notice, consent, purpose limitation, retention, breach reporting, children data, cross-border transfer, grievance redressal, DPO appointment if applicable). SOC 2: gap-map the Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy) against your current controls + draft the policies the auditor will request + identify the technical implementations the auditor will sample. ISO 27001: gap-map the 93 Annex A controls (ISO 27001:2022 revision) against current state + draft the ISMS scope statement + Statement of Applicability + risk treatment plan. The Retainer hours typically cover the gap analysis + initial policy drafting; full audit-prep (evidence collection, internal audit, audit-call preparation) is delivered through our separate Audit + Compliance service line.

Yes. Vendor risk is a high-volume Retainer activity for SaaS startups onboarding 5 to 15 new vendors per quarter. Cybersecify approach: review the vendor SOC 2 Type 2 report or ISO 27001 certificate (verify scope and exceptions), review the vendor DPDP/GDPR data processing agreement, map data flow (what personal data goes to vendor, in which region, retained for what period), identify residual risk (vendor breach notification cadence, sub-processor list, data deletion guarantee), draft a risk register entry and remediation plan. For high-criticality vendors (payment processors, identity providers, data warehouses), we recommend a vendor security questionnaire + a follow-up call with the vendor security team. The Retainer 10-hour monthly bucket typically covers 2 to 4 vendor reviews per month depending on vendor complexity; high-volume vendor onboarding cycles can be batched in a dedicated month or scoped as additional hours.

Yes. Incident response readiness is a Retainer offering and a common engagement trigger after a near-miss or competitor breach. Cybersecify approach: identify the 5 most likely incident scenarios for your specific business (ransomware on engineering laptops, customer data leak via misconfigured S3, leaked credential leading to admin takeover, employee phishing leading to internal account compromise, third-party vendor breach exposing your data). For each scenario, draft a playbook (detection signals, immediate containment actions, escalation chain, customer communication template, regulatory notification template per DPDP Section 7 + CERT-In Rule 14, post-incident review process). Run a tabletop exercise with your founders and senior engineering team to validate the playbook + identify gaps. Tabletop output is a written gap-list + remediation actions, typically 4 to 6 actions to close before the playbook is operational. Tabletop runs 2 hours; full playbook drafting cycle is 8 to 12 hours of Retainer time.

The Cybersecify Security Retainer is INR 24,999 per month for 10 hours of founder-led consulting. The 10 hours have a 30-day validity from the month start, with one free 30-day extension on unused hours (so unused September hours can be consumed by end of November, but not beyond). Hours do not stack across multiple extensions. Extra hours beyond 10 in a given month are billed at a flat INR 2,500 per hour. The 3-month minimum applies to the recurring subscription; cancellation after 3 months requires 30-day notice. Buyer-side reduction (going from 10 hours to a lower commitment) is not supported under the Retainer; for ad-hoc consulting under 5 hours per month, we recommend the engagement be re-scoped as project-based work instead.

Both founders deliver the Security Retainer engagement. Ashok S Kamat (CEO, focus on CTI + compliance + consulting + client delivery + business strategy + sales + ops) is the primary point of contact for compliance, vendor risk, vCISO-adjacent work, and customer-facing security calls. Rathnakara GN (CHO, OSCP + M.Sc Cyber Security + CompTIA PenTest+) is the primary point of contact for technical engineering pairing, threat modeling, architecture review, incident response drafting, and any code-level security work. Both founders are on every Retainer engagement; there is no junior consultant fallback. This is the founder-led delivery model that differentiates Cybersecify from agency-led consulting where the buyer signs with a senior and gets work from a junior. The 2026-06-05 pentest pivot does not change the Retainer delivery model; it remains founder-led for buyers in active engagement.

Yes. DevSecOps and SDLC integration is a common Retainer focus for engineering-heavy SaaS startups. Cybersecify approach: review your current SDLC (where in the cycle security touches it: usually nowhere, or only at pre-production scan), identify the highest-value insertion points (PR-level secret scanning, dependency CVE scanning, SAST baseline, container image scanning, IaC scan), pair with your engineering team to implement the controls without slowing the dev velocity (tooling choices, baseline tuning, false-positive triage process). Specific tools we routinely set up: gitleaks or trufflehog for secret scanning, Snyk or Dependabot for dependency CVE, Semgrep or Bandit for SAST, Trivy or Grype for container scan, Checkov or tfsec for IaC. We document the integration in your CI pipeline and train the engineering team on triage. The Retainer 10-hour budget can cover a phased rollout over 2 to 3 months.

Three reasons SaaS startups consistently cite for the Cybersecify Retainer over in-house hiring. (1) Cost: an in-house Senior Security Engineer in Bengaluru costs INR 30 to 60 lakh per annum fully loaded (salary + benefits + equity + tools + training); the Retainer at INR 24,999 per month = INR 3 lakh per annum, two orders of magnitude cheaper at the early stage. (2) Founder-led senior depth: the Retainer hours are delivered by two founders with combined 25+ years of security experience (OSCP + M.Sc Cyber Security + 10+ years CTI + delivery on 50+ engagements); a senior in-house hire at this depth would not be available at startup salaries. (3) No hiring cycle: a Series A security hire takes 3 to 6 months to source, interview, hire, and onboard; the Retainer starts in 2 weeks from contract signature. Most Cybersecify Retainer buyers convert to in-house security hire at Series B (when scale and dedicated focus justify the cost), with the Retainer continuing as advisory in parallel.