How do I hire an ethical hacker in India?
Key takeaways
- Any professional ethical hacker in India must supply a signed authorisation letter and rules of engagement before testing starts, or the work is unlawful under the IT Act, 2000.
- Ask for a redacted sample report; a vendor who cannot produce one is selling something other than a test.
- Indian VAPT is priced at roughly Rs 12,000-30,000 per tester-day plus 18% GST, so a quote materially below that band is missing scope.
- Verify any CERT-In empanelment claim on CERT-In's own published list, because the claim is easy to make and easy to fake.
- Prefer a fixed-price proposal with a named retest policy over an hourly rate, which rewards the wrong behaviour.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What should I check before I hire anyone?
Six things. A redacted sample report, so you can see whether it contains reproduction steps a developer could follow or merely tool output. A named methodology, such as PTES, OWASP ASVS or OSSTMM, because methodology is what makes two reports comparable. The number of tester-days planned and how many of them are hands-on rather than automated. The retest policy and whether it is included. Any CERT-In empanelment, verified on CERT-In's own published list. And a deliverable timeline that includes remediation support. Get all six in writing before you compare two vendors, because quotes that omit them are not comparable to quotes that include them.
What written authorisation should be in place?
A letter naming the exact systems, the exact dates, the exact test window, the named client contact, the testing IP addresses or source identity, the permitted techniques and the explicitly prohibited actions, plus a confidentiality clause and a data handling clause. A rules-of-engagement document covering the same ground should be signed by both sides. Consent must come from someone with authority over the systems. Consent obtained from a colleague who did not own the asset is not consent, and the engagement can still be an offence.
How do I avoid hiring a scammer or an unqualified operator?
The scams are obvious once you know them. A price arriving by return email with no questions about roles, endpoints or hosts. A complete web application assessed and reported in 48 hours. No sample report, no methodology, no answer on manual effort. A CERT-In empanelment claim you cannot verify. And a certificate offered with no report behind it. Separately, be careful with the word hacker: a genuine tester will describe scope, method and evidence, and will be visibly uncomfortable about a request that is not authorised testing.
How much should it cost and how should it be structured?
Roughly Rs 12,000 to Rs 30,000 per tester-day before GST, which puts a single web application at Rs 60,000 to Rs 3,50,000 depending on depth. Ask for a fixed price with a delivery date, a retest included, and GST as a separate line. Avoid hourly billing, because it rewards the slowest possible engagement. Avoid a scope agreed verbally. A useful final question is whether the retest is included, because that is where a cheap quote quietly becomes an expensive one later.
| Question | A good answer | A red flag |
|---|---|---|
| How many tester-days, and how many hands-on? | A number, with the automated share named | No answer, or a per-page price |
| What methodology do you work to? | PTES, OWASP ASVS, OSSTMM or a named equivalent | No methodology named |
| Can we see a redacted sample report? | Yes, with real reproduction steps | A sample full of tool output and plugin numbers |
| Is the retest included? | Yes, with the retest policy stated | A retest billed as a fresh engagement |
| Are you CERT-In empanelled? | The reference, which you verify on CERT-In's list | A claim you cannot find on CERT-In's list |
| What is the delivery timeline? | A date, with remediation support included | A full web application reported in 48 hours |
What are the frequently asked questions?
Get a straight answer on this
Send us the systems in scope and we will return a written scope, a fixed price and a rules-of-engagement document for signature.
Send us the details See pricing