How do I verify a cybersecurity vendor is legitimate in India?
Key takeaways
- Check MCA company registration and GST registration first, and confirm the legal entity name on the invoice matches exactly.
- CERT-In empanelment must be verified on CERT-In's own published list, matched by entity name and audit service category.
- Ask for a redacted report from work that resembles yours, in the same technology stack, and refuse a vendor that will not show one.
- Call a reference customer yourself, without the vendor on the call, and ask what the engagement was and what went wrong.
- A legitimate Indian firm will not be offended by verification, because verification is a short list of public and checkable facts.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
Which public records should you check?
Three, in this order. The Ministry of Corporate Affairs public record shows the company's registration status, its registered address, its directors and its financial filings, and it is free to search. The GST portal shows whether the entity is registered and active, and the GSTIN on your invoice should match the legal entity name exactly rather than being a close variant, because a mismatched name is how a subcontracting chain hides a non-responsible party. Third, CERT-In's published list of empanelled audit bodies, if empanelment is claimed, checked by exact entity name, service category and validity dates. Add the physical world: a real address, a business phone that is answered, and a domain that has been registered for a sensible period rather than last month.
What evidence of actual capability should you demand?
A redacted sample report, and the details to test it. Ask for work that resembles yours, in the same technology stack, not a report for a static brochure site. Then interrogate it: does each finding have reproducible steps, evidence, impact and a specific fix, or is it a list of tool names and severity scores. Ask who the named testers will be and how long they have been with the firm, because in India a small firm will usually tell you the truth and a large one will not. Ask how many tester-days are planned. And ask for the retest policy, because a firm that treats the retest as an optional extra is a firm that expects the finding list to be the product.
How do you check references and complaints properly?
Call the reference yourself, without the vendor on the call, and ask a specific question: what was the scope, how many tester-days, when was it delivered, and what went wrong. Indian vendors are used to being asked for a logo, and a company that cannot produce a reference you can reach is telling you something. In parallel, look for complaints rather than testimonials: a search for the legal entity name plus the service terms is more informative than a search for the brand name, which mostly returns marketing. Look for a pattern rather than a single complaint. One unhappy customer is normal. Two complaints about the same behaviour, such as missed deadlines or a report that did not match what was discussed, is a pattern.
What are the red flags that mean stop?
Stop if the price arrives by return email with no questions about your roles, endpoints or hosts. Stop if a full web application is reported within 48 hours. Stop if the vendor will not show a redacted report, or shows only a certificate. Stop if CERT-In empanelment is claimed and the entity is not on CERT-In's list under that name. Stop if the contract is missing a signed authorisation and a rules-of-engagement document, because testing your systems without written permission can expose you to liability under sections 43 and 66 of the Information Technology Act, 2000, and the Ministry of Electronics and Information Technology has confirmed in Parliament that ethical hacking with the owner's permission attracts no liability. Finally, stop if anyone is visibly uncomfortable about the authorisation conversation.
| Check | Where to verify | What disqualifies |
|---|---|---|
| Company registration | Ministry of Corporate Affairs public record | Dormant, or a registered address that is not a real place |
| GST registration | GST portal, matched to the invoice entity name | Legal entity name does not match |
| CERT-In empanelment | CERT-In published list of empanelled bodies | Claimed but not listed, or listed in the wrong category |
| Sample report | Vendor, redacted, comparable work | Only a certificate, or only tool output |
| References | Called by you, without the vendor present | No reachable reference, or a pattern of complaints |
| Authorisation and rules of engagement | Signed documents before testing starts | Testing begins on an email request alone |
What are the frequently asked questions?
Get a straight answer on this
Send us the legal entity name of any vendor you are considering and we will tell you which of these checks apply to them and what to ask for.
Send us the details See pricing