How do I choose a cybersecurity vendor in India?
Key takeaways
- A vendor that quotes a fixed price before asking about your roles, endpoints and hosts is guessing, not scoping.
- Ask who will actually do the work, by name, and ask for the tester-day count in the proposal as a line item.
- Verify CERT-In empanelment on CERT-In's own published list rather than trusting a logo on a proposal.
- Fixed-price engagements are the norm in India; hourly billing rewards the slowest possible engagement for no extra value.
- Indian VAPT is priced at roughly Rs 12,000-30,000 per tester-day plus 18% GST, so a quote far below that band is missing scope.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What should you ask before you compare prices?
Six questions, and the order matters. How many tester-days are planned, and how many of those are hands-on rather than automated? What named methodology do you work to, and against which standards such as OWASP, PTES or CERT-In guidance? Can you show a redacted sample report from comparable work? What is the retest policy, and is it included? Are you CERT-In empanelled for the specific audit type I need? And what is the deliverable date, including remediation support? A serious vendor answers all six before you have quoted a budget. A weak one asks for your budget first, because it intends to build a proposal around the number rather than the scope.
How do you verify claims instead of trusting them?
Verify, do not admire. CERT-In empanelment is checked on CERT-In's own published list, not on a logo. Company registration is checked on the MCA portal, and the GST registration should match the legal entity on your invoice. Look for a registered physical address and a working landline or business phone, and confirm the domain age and the team's LinkedIn history. AAVETech was founded in 2022 and operates from Nadavayal, Sulthan Bathery Road, near St. Thomas HSS, Kochi, Kerala 670721, with a published business phone and email, which is the kind of verifiable detail that separates a firm from a name on a WhatsApp contact card. Check that the person quoting has worked at the company for a plausible period.
What about price, and what is too cheap?
Indian VAPT is priced at roughly Rs 12,000 to Rs 30,000 per tester-day, plus 18% GST, so that band is your arithmetic anchor. Below it, the scope has been quietly reduced: fewer roles, unauthenticated testing only, no retest, or a report generated by a scanner. Ask for the tester-day count, the number of roles tested, the number of environments covered and the delivery date in the proposal, and check that the number is consistent with the price. A fixed price is the right structure. Hourly billing rewards slow work, and a quote that arrives by return email with no questions about roles, endpoints or hosts is a number picked to win the work rather than derived from it.
What should the contract and the deliverables contain?
The paperwork is where a good vendor and a bad one separate. You need a signed authorisation naming the systems in scope, a rules-of-engagement document with the test window, permitted techniques, an emergency contact and a stop word, an NDA and a data handling clause, and a statement that findings and evidence will be destroyed or returned. The deliverables should be a technical report with reproducible steps, a one-page executive summary for non-technical readers, a remediation plan with effort estimates, and a retest result listing every finding as fixed, partial or open. If the vendor offers a certificate instead of a report, that is a different product at a different price, and you should know which one you are buying.
| Check | Good sign | Warning sign |
|---|---|---|
| Scoping | Asks about roles, endpoints and hosts before pricing | Sends a price by return email |
| Reporting | Shows a redacted report from comparable work | Offers only a certificate |
| Methodology | Names a standard such as OWASP, PTES or CERT-In guidance | Says only manual and professional |
| Pricing | Fixed price with a stated tester-day count | Hourly, or below the market band |
| Retest | Included after your remediation | Billed as a fresh engagement |
| Credentials | CERT-In empanelment verifiable on CERT-In's list | Empanelment claimed but not listed |
| Paperwork | Signed authorisation and rules of engagement | Testing starts on an email request |
What are the frequently asked questions?
Get a straight answer on this
Send us your scope in writing and you will get a fixed price, a named methodology, a delivery date and the tester-day count within one working day.
Send us the details See pricing