Web application VAPT
Logins, access control and business logic in customer portals, SaaS products and banking apps.
Web application VAPTIndia · RBI · SEBI · IRDAI · DPDP · CERT-In
VAPT services in India from Sumrite, report in 48 hours.
Expert-led vulnerability assessment and penetration testing for Indian SaaS companies, fintechs, banks, NBFCs, brokers and insurers, run from New Delhi since 2007. Every finding verified by hand, every fix retested.
Based in New DelhiOkhla Phase 3, New Delhi. Testing for clients across India and worldwide.
Report in 48 hoursFor a scoped web application or API, with the retest of fixed findings included.
CERT-In audits, one teamFormal CERT-In audits are delivered through Sumrite’s empanelled partner while Sumrite runs the engagement.
Sumrite provides VAPT services in India from its base in New Delhi. It tests web applications, APIs, mobile apps, networks, cloud and IoT devices, verifies every finding by hand, includes a retest, and maps the report to what the requesting regulator or customer uses: RBI directions, the SEBI CSCRF, IRDAI guidelines, the DPDP Act, ISO 27001 or SOC 2. When a CERT-In empanelled audit is required, Sumrite runs the whole engagement and routes the formal audit through its empanelled partner.
Who needs VAPT in India?
In India, VAPT is usually required by a regulator, a government body or a customer contract rather than by one general law. These are the most common reasons Indian organisations commission a test:
| Requirement | Who it applies to | What it expects |
|---|---|---|
| SEBI CSCRF | Stock brokers, depository participants, asset managers, exchanges and other SEBI regulated entities | Regular VAPT of critical assets, with frequency and reporting set by entity category; the cyber audit is done by a CERT-In empanelled auditor |
| RBI directions | Banks, NBFCs, payment system operators and other RBI regulated entities | Board oversight of IT risk, regular vulnerability assessment and penetration testing, and tracked remediation |
| IRDAI guidelines | Insurers and insurance intermediaries | Periodic security testing and audit of information systems under the IRDAI information and cyber security guidelines |
| DPDP Act and Rules | Every organisation processing digital personal data of people in India | Reasonable security safeguards under section 8(5) and Rule 6; tested controls are the best evidence you took them |
| CERT-In audits | Government and public sector systems, government-hosted sites, tenders that name CERT-In | An audit by a firm on CERT-In’s empanelled list, with a report and certificate in that firm’s name |
| Customer and audit evidence | SaaS, fintech and IT companies selling to enterprises in India and abroad | An independent VAPT report for SOC 2, ISO 27001, PCI DSS or a vendor security review |
How often is VAPT required in India?
Most Indian regulators and CERT-In’s audit guidelines expect testing at least once a year and after any significant change to an application or its infrastructure. SEBI sets the frequency by entity category, and some regulated entities test critical systems more often. A customer contract can also set its own cycle. Sumrite plans the calendar with you so that the test, the fixes and the retest are finished before your submission or audit date.
VAPT services Sumrite delivers in India
API security testing
REST and GraphQL APIs behind UPI, lending and partner integrations, tested for BOLA and broken authorisation.
API testingMobile app VAPT
Android and iOS apps tested against OWASP MASVS, including the APIs behind them.
Mobile app VAPTNetwork VAPT
External and internal networks, Active Directory and segmentation, on site in Delhi NCR or remotely.
Network VAPTCloud security
AWS, Azure and Google Cloud configuration review and cloud penetration testing.
Cloud testingIoT and hardware
In-house device, firmware and radio testing for Indian hardware and IoT makers.
IoT testingHow a CERT-In audit works with Sumrite
- Confirm the requirement. We read the circular, tender or contract with you and confirm whether it needs an empanelled auditor or an audit as per CERT-In guidelines.
- Scope and NDA. Every URL, API, build and IP range is listed before testing starts, and an NDA is signed first.
- Expert-led testing. Sumrite’s testers run the assessment by hand, following CERT-In’s audit guidelines.
- Fix and retest. Your team fixes the findings with our guidance; we retest and record the closure of each one.
- Empanelled report. The formal audit report and certificate are issued through Sumrite’s CERT-In empanelled partner, so you deal with one team throughout.
Why Indian teams choose Sumrite
- Since 2007, from New Delhi. Sumrite has taken more than 250 clients through audits, buyer reviews and regulator checks.
- Expert-led, not scanner exports. Every finding is reproduced and verified before it reaches your report.
- One team end to end. Testing, remediation support, retest and, where needed, the CERT-In empanelled audit through our partner.
- Reports regulators and buyers can read. An executive summary for the board and full reproduction steps for engineers, mapped to RBI, SEBI, IRDAI, DPDP, ISO 27001 or SOC 2.
- Free tools. A free website and app scan at scan.sumrite.com and a free DPDP personal data discovery tool at dpdp.sumrite.com.
VAPT cost in India
The price of a VAPT in India depends on the number of applications, APIs, user roles and hosts, the depth of testing and whether a CERT-In empanelled report is needed. Sumrite gives a fixed-scope quote in rupees for Indian clients, with the retest included. See how Sumrite prices a penetration test and the VAPT cost guide, or compare providers in the top 10 VAPT companies in India.
Delhi NCRVAPT services in DelhiOn-site and remote testing from Okhla, New Delhi.CERT-InCERT-In empanelled VAPT auditHow Sumrite runs the audit end to end.DPDP ActDPDP Act compliancePenalties, the Rules 2025 timeline and a free PII tool.
Frequently asked questions
Which is the best VAPT company in India?
The best provider is the one that fits your requirement: whether a regulator needs a CERT-In empanelled auditor, what you need tested and how much expert-led depth you need. Compare sample reports, tester experience, methodology and whether a retest is included. Sumrite publishes a fair comparison of ten VAPT companies in India.
Is VAPT mandatory in India?
There is no single law that makes VAPT mandatory for every company. It is required for entities regulated by SEBI, the RBI and IRDAI, for many government systems through CERT-In audits, and in practice by enterprise customers and auditors. The DPDP Act also requires reasonable security safeguards, which testing helps you prove.
Do I need a CERT-In empanelled auditor?
Only when a regulator, government body or contract asks for one. For SOC 2, ISO 27001 or a customer review, an independent expert-led VAPT report is enough. When an empanelled audit is required, Sumrite runs the engagement and routes the formal audit through its CERT-In empanelled partner.
How long does a VAPT take in India?
For a scoped web application or API, Sumrite delivers the report within 48 hours of testing starting. Larger scopes, such as several applications or an internal network, take longer; the timeline is confirmed in the fixed-scope quote.
Can Sumrite test on site in India?
Yes. Sumrite is based in Okhla, New Delhi, and can test internal networks on site in Delhi NCR. Most application, API and cloud testing is done remotely.
Other regions
Need a VAPT report for an Indian regulator or customer?
Tell us who is asking and by when. NDA first, fixed-scope quote, retest included.