What is AI-driven ethical hacking in India?
Key takeaways
- AAVETech is a Kochi-based firm that runs AI-assisted reconnaissance and payload generation with human testers performing exploitation and reporting.
- A penetration test in India costs Rs 40,000 to Rs 12,00,000 excluding 18% GST, and the AI-assisted variant sits at the lower end of that band for a web application.
- CERT-In Directions 20(3)/2022-CERT-In, effective 27 June 2022, require incident reporting within 6 hours, which shapes how much testing depth a client can afford per release cycle.
- AI-assisted triage is the part that saves money: repeating the same reconnaissance across a 200-endpoint API is machine work, and it is billed at a fraction of a tester-day.
- Non-compliance with CERT-In directions can attract action under section 70B(7) of the IT Act, 2000, including imprisonment up to 1 year and a fine up to Rs 1 lakh.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What does the AI actually do in an AI-driven engagement?
Four jobs, and they are all volume jobs. Reconnaissance: enumerating hosts, subdomains, endpoints, JavaScript files, exposed storage buckets and API schemas across a large estate. Fuzzing: throwing malformed and hostile inputs at parameters, headers and endpoints to find crashes and injection points. Triage: ranking the raw results, deduplicating them and discarding the noise that a scanner produces by the thousand. Payload generation: adapting test strings to the stack the target actually runs, so a template scanner signature does not determine the result. None of these four jobs needs judgement, and that is exactly why they are worth automating. What does need judgement is deciding whether a crash is reachable, whether a finding is a real business risk, and how to prove it without damaging the client.
Why do the human testers still matter in AI-driven ethical hacking?
Because a scan result is a hypothesis and a penetration test needs a verdict. AI fuzzers produce volume, but every one of those results has to be triaged: is this a real injection into a database that holds customer data, or an error page on a static asset? A human tester decides that, then proves it by extracting a limited, controlled sample, and only then writes it up in language a developer can act on. In our practice the machine typically generates several hundred candidate findings and the human tester confirms a few dozen real ones. The other reason the human stays is legal and ethical: authorisation, scope boundaries, safe exploitation and the decision to stop all come from a named person, not from a model.
What does an AI-driven ethical hacking engagement cost in India?
Pricing in India is driven by scope, not by the tooling. A static website test is Rs 40,000 to Rs 90,000 excluding 18% GST. A web application test is Rs 1,20,000 to Rs 3,50,000. A mobile app is Rs 1,00,000 to Rs 3,00,000. An API of 50 to 150 endpoints is Rs 1,00,000 to Rs 4,00,000. Internal network and Active Directory testing is Rs 1,50,000 to Rs 6,00,000. The underlying commercial rate is roughly Rs 12,000 to Rs 30,000 per tester-day, and AI tooling usually reduces the tester-days spent on enumeration, not the number of days spent proving impact. A client whose real problem is an untested API with 200 endpoints gets the largest saving, because that is where the machine's hours replace a human's hours.
When is AI-assisted testing the wrong choice for an Indian business?
Four cases. First, if you need defensible evidence for a regulator or a litigation, a recorded manual test with timestamps and a chain of custody carries more weight than an automated finding list. Second, if your business logic is the thing that matters, a payment-splitting rule or a discount engine with 14 branches: machine fuzzers find the injection point, not the abuse case. Third, if you are in a regulated sector where change control freezes the environment — banking, insurance, government — because a scanner that is too eager creates noise in production. Fourth, if the target is small and stable, a Rs 60,000 external perimeter test with a human tester will beat an AI-led platform engagement that has to be paid for and configured first.
| Task | Who does it | Why it matters in an Indian engagement |
|---|---|---|
| Asset and endpoint enumeration | AI-assisted tooling | A 200-endpoint API is enumerated in hours instead of tester-days |
| Fuzzing and payload generation | AI-assisted tooling | Stack-aware payloads beat a static scanner signature |
| Confirming reachability and impact | Human tester | Decides whether a finding is a real risk to customer data |
| Safe, controlled exploitation | Human tester | Scope boundaries and the decision to stop are a person's call |
| Report and remediation guidance | Human tester | A developer can only act on a finding that has been proved |
What are the frequently asked questions?
Get a straight answer on this
Send us the number of endpoints or the external IP range you want covered, and we will return a fixed-price scope with a start date.
Send us the details See pricing