How do I hire an ethical hacker in India without getting scammed?

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

What should you check before you sign anything?

Six things, and you want all six in writing before you compare two vendors. A redacted sample report, so you can see whether it contains reproduction steps a developer could follow or merely tool output. A named methodology, such as PTES, OWASP ASVS or OSSTMM, because methodology is what makes two reports comparable. The number of tester-days planned, and how many of those are hands-on rather than automated. The retest policy, and whether the retest is included in the price. Any CERT-In empanelment, which you verify yourself rather than trusting the claim. And a delivery timeline that includes remediation support, because a report with no help fixing the findings is half a product. If a vendor cannot answer these six, you are not comparing tests, you are comparing brochures.

What written authorisation has to be in place?

A letter naming the exact systems, the exact dates, the exact testing window, the named client contact, the testing source IP addresses or source identity, the permitted techniques and the explicitly prohibited actions, plus a confidentiality clause and a data handling clause. A rules-of-engagement document covering the same ground should be signed by both sides before the first packet. Consent must come from someone with authority over the systems being tested. Consent obtained from a colleague who did not own the asset is not consent, and the engagement remains an offence under the IT Act, 2000 even if the tester believed otherwise. Keep the signed copy: in a client audit, an internal investigation or a dispute, it is the artefact that separates an authorised test from an intrusion.

How do you avoid hiring a scammer or an unqualified operator?

The scams are obvious once you know the shape. A price arriving by return email with no questions asked about roles, endpoints or hosts. A complete web application assessed and reported in 48 hours. No sample report, no methodology, no answer about manual effort. A CERT-In empanelment claim that cannot be found on CERT-In's list. A certificate offered with no report behind it, since there is no statutory certification called a certified ethical hacker in India. Be careful with the word hacker as well: a genuine tester will talk about scope, method and evidence, and will be visibly uncomfortable with a request that is not authorised testing. If the conversation is about accessing someone else's account or device, the answer is no, regardless of price.

How should the engagement be priced and structured?

Roughly Rs 12,000 to Rs 30,000 per tester-day before GST, which puts a single web application in the region of Rs 60,000 to Rs 3,50,000 depending on depth, and a full external and internal assessment with a retest comfortably above that. Ask for a fixed price with a delivery date, a retest included, and GST as a separate line. Avoid hourly billing, because it rewards the slowest possible engagement, and avoid a scope agreed verbally over a call, because scope is where disputes live. A useful final question is whether the retest is included, since that is where a cheap quote quietly becomes an expensive one once the findings arrive.

What are the frequently asked questions?