169 questions · one answer each

What cyber security questions does AAVETech answer?

These are the 169 security questions AAVETech is asked most, in India, answered one per page. Each page opens with a direct answer, states the numbers and the law that apply, and ends with the specific next step. They are written for people who need to act, not for people collecting certifications.

Key takeaways

169 questions, each with its own page, its own direct answer and its own canonical URL.
Grouped by intent: service questions, problem questions, and comparison and trust questions.
Every answer states a real number, a real law or a real price, with the source attributed.
No ranking claims anywhere on this site. AAVETech makes no claim about being the top firm in India, because that is not a fact a reader can verify.

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

What are all 169 questions?

Every question below has its own page, with a direct answer at the top, key takeaways, comparison tables where they help, and a specific next action at the end.

How much does a penetration test cost in India?

Penetration test cost in India in 2026: Rs 40,000-90,000 for a static site, Rs 1.2-3.5 lakh for a web app. Full price bands and what changes them.

How much does a VAPT cost for a small business in Kerala?

VAPT cost for Kerala small businesses in 2026: Rs 60,000-1.5 lakh for a focused external test. What a small firm should prioritise and what to skip.

Do you offer a free cybersecurity assessment for my startup?

Yes. AAVETech offers a free 30-minute scoping call and a free initial exposure review for early-stage Indian startups. What is included and what it is not.

How do I hire an ethical hacker in India?

How to hire an ethical hacker in India in 2026: the six checks separating a real tester from a scammer, what written authorisation needs, and the price bands.

Is it legal to hire a hacker in India?

Yes. India's IT Act 2000 says ethical hacking with owner consent attracts no liability. What consent must contain and when hiring a hacker becomes a crime.

How do I find a cybersecurity company near me in Kochi?

How to find a cybersecurity company in Kochi in 2026: what to verify, expected VAPT cost from Rs 60,000, local response times and first-call questions.

What is a red team engagement in India and what does it cost?

Red team engagement cost in India in 2026: Rs 2.5-12 lakh for a typical operation, what a red team does that a pentest does not, and how it is scoped.

Do you provide 24/7 managed detection and response for SMEs?

Yes. AAVETech provides 24/7 managed detection and response for Indian SMEs, from Rs 2.5-6 lakh a year, with 4-hour emergency response for retainer clients.

Can you do an external vulnerability assessment without giving my team logins?

Yes. AAVETech runs external vulnerability assessments with no credentials, using black-box testing of your public perimeter, apps, APIs and cloud exposures.

How long does a full VAPT engagement take?

A full VAPT engagement in India takes 5 to 10 working days for one application, 10 to 20 for internal network testing, plus a 2 to 4 day retest after fixes.

Do you offer SOC 2 or ISO 27001 readiness consulting?

Yes. AAVETech provides ISO 27001 readiness consulting and SOC 2 preparation for Indian companies, from gap analysis to audit, using ISMS and TSC controls.

Can you help us get compliant with the DPDP Act?

DPDP Act 2023 compliance help for Indian companies: data inventory, consent, breach notification and the May 2027 Rule 7 deadline, with 83% yet to begin.

What is a CERT-In empanelled auditor and do I need one?

A CERT-In empanelled auditor is an organisation listed on CERT-In's own empanelment list for IT security audits. When you need one, and how to verify the claim.

How do I respond to a suspected data breach in India?

How to respond to a suspected data breach in India: isolate, preserve logs, report to CERT-In within 6 hours, and file on cybercrime.gov.in or helpline 1930.

Can you test our WhatsApp Business and social media accounts for takeover?

Yes. AAVETech audits WhatsApp Business, Instagram, Facebook and Google accounts for takeover risk, including the CERT-In High-severity GhostPairing campaign.

Do you offer employee cyber awareness training for Indian companies?

Employee cyber awareness training for Indian companies in 2026: Rs 25,000-60,000 per campaign, phishing simulation, DPDP and CERT-In aligned content.

Can you remove a deepfake video of me from the internet?

Deepfake video removal in India: preserve evidence, report in-app, file on cybercrime.gov.in or 1930, and use the 2-hour and 3-hour IT Rules takedown clocks.

Do you offer digital forensics and incident response for individuals?

Digital forensics for individuals in India: phone and account compromise, evidence preservation, and help with cybercrime.gov.in and 1930 complaints.

How do I get a CERT-In compliant incident report?

How to get a CERT-In compliant incident report in India: 6-hour reporting, 180-day logs, incident classification and a report that maps to Annexure I.

Can you audit our third-party vendors for security?

Yes. AAVETech audits third-party vendors for security: questionnaires, breach history, privileged access, supply chain and re-test of vendor findings.

Do you provide cybersecurity for hospitals and clinics in Kerala?

Cybersecurity for Kerala hospitals and clinics in 2026: segmentation, offline backups, 180-day logs, an 800GB patient data breach and CERT-In's 6-hour rule.

What is a red team exercise and how is it different from a pentest?

Red team exercise versus penetration test: scope versus objective, deliverables, cost and the sequence that reduces total cost for Indian companies.

Can someone hack my wife's phone without her knowing?

Yes, it is possible, and the usual routes are a malicious link, a WhatsApp pairing-code attack or a SIM swap. Here is what to check in the first hour.

Can my phone be hacked without me knowing?

Yes, but a compromised phone usually leaves traces. The six indicators that reveal it, what to change tonight, and the two-hour reporting window.

How do I know if my email was hacked?

Check four places in five minutes: the sent folder, inbox rules, login activity and recovery contacts. What to look for, and what to change first.

How do I remove a deepfake video of me?

India's amended IT Rules set a 3-hour takedown clock for AI-generated content and 2 hours for NCII. Here is the exact takedown sequence to follow.

How do I know if my WhatsApp has been hacked?

Open WhatsApp, go to Settings and Linked Devices, and check for a session you do not recognise. The two-minute check, plus what GhostPairing actually is.

Someone is impersonating me on Instagram — what do I do?

An impersonation account on Instagram is a reportable, time-bound takedown. Here is the exact sequence to lock, report, document and escalate it.

How do I know if a video call is a deepfake?

Real-time deepfake video calls now defeat face recognition and Video-KYC. Here are the behavioural tells and the verification steps that actually work.

My bank account was drained by a fraud call — what should I do first?

Call the bank's fraud helpline first, then report on cybercrime.gov.in and 1930. The five-day rule that decides your compensation, step by step.

I got a "digital arrest" call — what is it and what do I do?

A digital arrest is a scripted coercion scam posing as CBI, ED or police. Here is what it is, what to do in five minutes, and why five days matters.

How do I stop fake AI endorsement ads using my face?

Fake AI endorsement ads using your face are a brand-protection problem. Here is the takedown sequence, the platform routes and the ads-tool evidence trail.

What is a SIM swap attack and how do I prevent it?

A SIM swap moves your number to an attacker's SIM so your OTPs follow. Here is how it is executed, the warning signs and the port-out lock that stops it.

How do I remove an AI-generated intimate image of me?

The amended IT Rules require removal of AI-morphed intimate images within 2 hours. How to make a complaint that gets acted on, and how to seek court help.

How do I know if my company has been targeted by ransomware?

Ransomware in India runs on double extortion. The eight indicators, the 6-hour CERT-In clock, and how to confirm encryption without tipping off the attacker.

What should I do in the first 6 hours after a data breach?

CERT-In requires listed incidents to be reported within 6 hours. Here is the hour-by-hour sequence, what to put in the report, and why clock sync decides it.

How do I recover from a ransomware attack in India?

Recovery is a reporting-first event, not a restoration-first one. The first 6 hours in order, the credential rotation people forget, and exfiltration testing.

Why did my Instagram account get hacked even with 2FA?

Six reasons 2FA fails: SMS bombing, device-code phishing, OAuth tokens, recovery-email takeover, SIM swap and session theft. Here is the real fix for each.

How do I protect my parents from AI voice-clone scams?

Voice clones are now good enough to defeat family recognition. Here is a one-hour family protocol, the bank-side controls, and the words that stop a call.

How do I check if my data has been sold on the dark web?

A dark web search confirms exposure but cannot prove a breach. Here is how to search lawfully, what a result actually proves, and what to do next.

Why is my business being targeted by ransomware even though I am small?

Size is not a defence. Here is why small Indian businesses are targeted, the 4 controls that actually cut your risk, and what to do this month.

How do I secure our school's or hospital's patient data?

Segmentation, offline backups, 180-day logs and a 6-hour runbook. Here is a 90-day plan for a hospital or school, with the Indian regulatory anchors.

What is the difference between a penetration test and a vulnerability assessment?

Penetration test vs vulnerability assessment: what each finds, what each costs in India, and why most SMEs need an assessment first and a test to prove it.

How do I choose between a vulnerability assessment, a penetration test and a red team engagement?

Choosing between a vulnerability assessment, a penetration test and a red team in India: what each answers, what it costs and the right order for most firms.

Should I buy cyber insurance in India?

Cyber insurance in India in 2026: what it costs, what it excludes, and the control posture underwriters price you on before they will issue a policy.

Is a cyber security certificate worth it in India?

Is a cybersecurity certificate worth it in India in 2026: what employers check, which certifications map to real jobs, and what a certificate cannot replace.

How do I choose a cybersecurity vendor in India?

How to choose a cybersecurity vendor in India: the checks that disqualify weak firms, what to ask about testers, pricing, reporting and CERT-In empanelment.

What questions should I ask a penetration testing vendor?

The questions to ask a penetration testing vendor in India before accepting a quote: tester-days, methodology, sample report, retest and CERT-In empanelment.

What is a CERT-In empanelled auditor and why does it matter?

What a CERT-In empanelled auditor is, how empanelment is granted by service category, where India legally requires it and where it is a procurement expectation.

How is a security assessment different from a compliance audit?

Security assessment versus compliance audit in India: what each proves, who pays attention to each, and why most firms need both an audit and a test.

Managed security service vs in-house security team — what is cheaper in India?

Managed security service versus an in-house security team in India: real cost bands, what a managed SOC covers, and where hiring in-house genuinely wins.

How much does cyber security training for employees cost in India?

Employee cyber security training cost in India in 2026: what one-off awareness sessions cost, what phishing simulations cost, and how to measure if it worked.

What should be in our incident response plan for DPDP?

What an Indian incident response plan needs for DPDP: the CERT-In six-hour clock, DPDP Rule 7 notification from May 2027, roles, evidence handling and testing.

How do I read a penetration test report?

How to read a penetration test report: what each section means, which findings to fix first, how to tell a real exploit from a scanner alert, and what next.

What is the difference between a red team and a purple team in India?

Red team versus purple team in India: objectives, rules of engagement, cost, and the sequence that actually reduces detection gaps in a monitored environment.

Are free security scanners enough for a small business?

Are free security scanners enough for a small Indian business? What they genuinely catch, what they miss, and the realistic low-cost way to cover the gaps.

How do I verify a cybersecurity vendor is legitimate in India?

How to verify a cybersecurity vendor is legitimate in India: MCA and GST checks, CERT-In empanelment, sample reports, references and the red flags.

What are the red flags in a cheap penetration testing quote?

Red flags in a cheap penetration test quote in India: six warning signs, the tester-day arithmetic behind true cost, and what to ask instead of price.

What is AI-driven ethical hacking in India?

AI-driven ethical hacking means machine-assisted testing with a human tester exploiting every finding. Here is what the AI does, and what it costs.

How does AI change the cost of a penetration test in India?

AI cuts the enumeration and triage hours, not the exploitation hours. Here is the rate card, where the saving actually lands, and what a quote should itemise.

Can AI find vulnerabilities that a human tester misses?

Yes, in volume and in patterns no human would sit through, and no, in the chains of reasoning that make a finding matter. Here is exactly where each one wins.

How do you detect a deepfake video of an Indian CEO?

Five technical signals and one procedural control that actually stops a deepfake CFO call. SEBI named the pattern on 17 July 2026. Here is the checklist.

How do you remove a deepfake video from the internet in India?

Six removal routes in India: platform grievance, IT Rules 2026 deadlines, police complaint, takedown to intermediaries, and the one route that does not work.

Is AI voice cloning a real risk for Indian families?

Yes, and it is now a family-scale risk, not a corporate one. Here is the evidence from 2026 Indian cases, and the four rules that stop most of it.

How do you tell if a video call is a deepfake in India?

Six live checks you can run on a video call in seconds, plus the two procedural questions that end the call if the answers are wrong to them.

What is a deepfake scam and how do you report one in India?

A deepfake scam uses synthetic media to impersonate a person you trust. Here is the definition, the four reporting routes, and what happens after you file.

How do you protect your face from AI misuse in India?

Six practical controls for your face data in India: publish less, lock down your accounts, watch for impersonation, and use a watermark plus monitoring.

How do you stop AI-generated fake endorsements using your face?

The pattern in India: a fake ad, a fake WhatsApp post, a fake website. Here is how to detect it, report it in 3 hours, and stop the money flowing.

What is AI abuse detection for Indian social media accounts?

AI abuse detection watches your social accounts for impersonation, harassment and fraud. Here is what it monitors, what it cannot do, and what it costs to run.

How do you check if your likeness is being used in AI content?

Six checks, from reverse image search to forensic comparison, plus a monthly routine and what to do the moment you find a match online in India.

What is the DPDP Act and how does it affect my business in India?

The DPDP Act 2023 in plain terms: consent, notice, purpose limitation, breach reporting, penalties up to Rs 250 crore, and what starts in May 2027.

How do I verify a CERT-In empanelled auditor claim in India?

Three checks on CERT-In's own published list, the exact registered name to match, and why a PDF certificate in an email is not evidence of empanelment.

How do I prepare for a DPDP Act compliance audit in India?

A six-week preparation plan: consent, notice, data mapping, security, breach readiness and evidence, mapped to the staged DPDP Rules 2025 commencement.

What is the IT Rules 2026 deepfake takedown timeline in India?

Effective 20 February 2026: flagged content in 3 hours, non-consensual imagery in 2 hours, grievances in 7 days, and mandatory AI labelling.

How do I hire an ethical hacker in India without getting scammed?

Six checks that separate a real tester from a scammer in India, what written authorisation must contain before testing starts, and honest price bands for 2026.

Is it legal to hire a hacker in India for authorised penetration testing?

It is legal, and the line is written into the IT Act, 2000. Here is what written consent must cover, and what sections 43 and 66 make criminal.

How much does it cost to hire a certified ethical hacker in India?

There is no statutory certification called a certified ethical hacker in India. Here are the real 2026 price bands, per engagement and per tester-day.

What does a certified ethical hacker do during an engagement?

Scoping, rules of engagement, reconnaissance, exploitation, reporting and retest, in that order. Here is what a real Indian engagement looks like.

What is the difference between a penetration tester and an ethical hacker?

The difference is scope, method, output and legal footing. One is a job you hire against a defined scope, the other is a title anyone can print.

How do you verify an ethical hacker is legitimate in India?

Eight checks you can run in an afternoon: GST against the legal name, CERT-In empanelment on the published list, a real office and a sample report.

How long does an ethical hacking engagement take in India?

A single web application takes 2 to 3 weeks end to end. Here is the realistic calendar for scoping, testing, reporting and retest, and what makes it longer.

What is a bug bounty program and is it right for an Indian SME?

A bug bounty pays researchers for valid vulnerabilities instead of hiring testers on a schedule. Here is when it works for an Indian SME, and when it does not.

How do you run a bug bounty programme for your Indian startup?

Eight steps from first scope to first payout, with a 90-day launch plan, a bounty matrix you can copy, and the 72-hour triage rule that matters most.

What is a red team assessment and what does it cost in India?

A red team is an objective-driven adversary simulation, not a vulnerability list. Here is what it covers, what it costs in India, and how it differs.

How do you run a phishing simulation for Indian employees?

A safe, legal, measurable way to test your staff: the 8-step runbook, the rules that keep it lawful, the metrics that matter, and what it costs in India.

What is social engineering testing for Indian companies?

Social engineering testing measures how far a person can be persuaded. Here is what it covers in an Indian context, how it is scoped legally, and what it costs.

How do you get a CERT-In aligned incident report in India?

The 6-hour notification, what the report must contain, and the difference between a CERT-In notification, a police FIR and a forensic report. Here is the order.

How much does cybersecurity cost for an Indian startup?

Indian startups spend between Rs 50,000 and Rs 10 lakh a year on security. Here is what each band buys, which line items to fund first, and what to skip.

How do Indian startups get a cybersecurity assessment cheaply?

Four practical routes to a cheap Indian security assessment: scoped testing, an empanelled auditor, open-source tooling, and a staged retest. Real price bands.

What should an Indian startup's first security budget be?

A practical first security budget for an Indian startup: Rs 1.5 lakh for the first year, split across four named line items and one retainer.

Do I need cybersecurity compliance before raising funding in India?

You do not need a certification to raise in India, but investors will test your security readiness. Here is the checklist that actually comes up.

How do I secure my startup's customer data in India?

Six controls that protect Indian startup customer data: minimisation, encryption, access control, 180-day logs, DPDP consent records and a tested restore.

How do Indian startups prepare for a security audit in India?

Indian startups that prepare well spend two weeks before an audit and pass in days. Evidence to collect, auditor access, gaps to fix, and the CERT-In drill.

How do I secure an MVP before launching in India?

Seven checks to run on an Indian MVP before launch: MFA, secrets, database exposure, APIs, third-party scripts, logging and a first external test.

What is a security roadmap for a 10-person Indian startup?

A four-quarter security roadmap for a 10-person Indian startup, with budgets, owners and the CERT-In and DPDP Act milestones in each quarter.

How do I hire a security engineer in India on a small budget?

Indian startups hire security engineers on small budgets as fractional or contract hires, not full-time. Here are real pay bands and the skills to screen for.

How much does ransomware recovery cost for a small business in India?

Ransomware recovery for an Indian small business runs from about Rs 1 lakh for a clean restore to Rs 25 lakh without backups. Here is the cost breakdown.

What should a small business do in the first 24 hours of ransomware?

The first 24 hours of a ransomware incident, hour by hour: isolate, do not wipe, preserve logs, report to CERT-In within 6 hours, and communicate.

Does cyber insurance cover ransomware in India?

Yes, usually, but not automatically. What Indian cyber policies typically cover, what they exclude, and the 4 things to check before you buy.

How do small Indian businesses prevent ransomware?

Six prevention controls that stop most ransomware in Indian small businesses: MFA, patching, backups, segmentation, email hygiene and least privilege.

How do I know if my small business has ransomware?

Six signs of ransomware in a small Indian business, how to confirm them in 20 minutes without spreading it, and the one check that rules it out.

What is ransomware as a service and why does it hit small firms?

Ransomware as a service is a subscription criminal supply chain. Here is how it works, why small firms are targeted, and what that changes for your defences.

Should a small business pay the ransomware ransom in India?

The honest answer is usually no, and the reasons are legal, practical and statistical. Here is how the decision actually works, and when paying may be rational.

How do I back up my business data against ransomware in India?

The 3-2-1 backup rule made ransomware-proof: offline or immutable copies, a separate admin account, quarterly tested restores, and 180-day log retention.

How do I check whether my business is being targeted by ransomware?

Seven warning signs that ransomware is targeting your Indian business, from log analysis and Windows event IDs to credential-market checks and exposure scans.

How do I protect my brand from deepfake misuse in India?

Deepfake brand abuse spreads in hours, not days. Here is the Indian legal and platform route: evidence, notices, the 3-hour IT Rules clock and a court backup.

How do content creators protect their identity from AI misuse?

Creators are trained on their own public videos. Here is how to reduce your exposure, watermark your work, and get misuse taken down in India.

How do I secure my social media accounts as a creator in India?

A creator account is a business account with a public handle. Here is the hardening sequence: recovery contacts, app passwords, 2FA, and the takeover response.

How do I remove a fake profile impersonating me in India?

Report a fake profile within hours, not days. Here is the Instagram, WhatsApp and YouTube reporting flow, the evidence to capture, and the legal backup.

How do I check if my personal data has been leaked in India?

A leak check tells you what to fix first. Here is how to search lawfully, what a result actually proves, and what changes for your PAN, Aadhaar and UPI.

How do I protect my parents from AI voice-clone scams in India?

Voice clones now defeat recognition. Here is the one-hour family protocol, the bank-side limits to request, and the exact words that end the call.

What should I do if my phone has been hacked in India?

A suspected phone hack has a first hour. Here is the containment order, the six-hour CERT-In clock, the 1930 route, and what to photograph before you reset.

How do I secure my office Wi-Fi in India?

An open office wifi is an open door. Here is how to harden WPA3, split guest traffic, hunt rogue access points and set a log that holds up in a dispute.

How do I secure my home Wi-Fi for my family?

Home wifi in India now carries UPI logins, work mail and school portals. Here is how to set a strong password, update firmware and lock down DNS.

What is a rogue Wi-Fi hotspot and how do I avoid it?

A rogue hotspot can sit in your office lobby and quietly read traffic. Here is how evil twin attacks work, what CERT-In advisories say, and how to spot one.

What is ARP spoofing and how do I prevent it?

ARP spoofing lets an attacker sit in the middle of your network silently. Here is how the man-in-the-middle works and how dynamic ARP inspection stops it.

What is DNS hijacking and how do I prevent it?

DNS hijacking quietly redirects every site you visit. Here is how resolver control, DNS over TLS and DoH protect a Kerala office network end to end.

How do I secure my router and firewall?

Your router is the front door of the network. Here is how to lock the management plane, update firmware, tighten rules and keep logs worth reading.

What is a zero-day vulnerability?

A zero-day is a flaw attackers use before a patch exists. Here is how disclosure works, why patching lags, and what an Indian business should do now.

How does patch management actually work?

Patching fails on inventory, not on effort. Here is a realistic CVE and SLA process an Indian business can run without a dedicated security team.

What is log management and why does it matter?

Logs are evidence, and evidence expires. Here is what CERT-In expects, how SIEM fits an Indian office, and what to keep for 180 days after an incident.

How do I monitor my network for intrusion?

You cannot watch every packet. Here is how intrusion detection, network detection and anomaly rules actually work inside an Indian office network.

What does network penetration testing involve?

A network penetration test is scoped, authorised and evidenced. Here is what internal and external testing covers, and what the deliverables look like.

How do I secure my AWS, Azure or GCP cloud account?

Lock down IAM, network rules and storage on AWS, Azure and GCP. CIS benchmark steps, MFA enforcement and audit logs an Indian team can run today.

What is cloud misconfiguration and how do I fix it?

Cloud misconfiguration is the leading cause of cloud breaches. Learn how public buckets, over-permissive roles and CSPM tools find and close the gaps fast.

Is my data safe in the cloud?

Cloud storage is not automatically safe. Data residency, encryption, shared responsibility and the DPDP Act decide where your data sits and who is liable.

What is an API security test?

An API security test breaks authentication, authorisation and rate limits in your API. Here is what a penetration test of an API actually covers, step by step.

How do I secure my REST API?

Secure a REST API with OAuth scopes, strict JWT validation, rate limiting and audit logging. A practical checklist for teams shipping APIs in India.

How do I secure my mobile app?

Mobile app security covers local storage, certificate pinning, root and jailbreak detection, and what to fix before your next release goes to the store.

What is mobile app security testing?

Mobile app security testing combines static and dynamic analysis against OWASP MASTG checks, with network interception, storage review and reverse engineering.

How do I secure my web application against XSS?

Stop cross-site scripting with context-aware output encoding, a strict content security policy, server-side sanitisation and safe framework defaults.

What is SQL injection and how do I prevent it in my web application?

SQL injection puts attacker input into a database query unchecked. Prevent it with parameterised queries, stored procedures, least privilege and validation.

What is secure code review and how does it fit a security audit?

Secure code review checks every change against OWASP ASVS before it ships, with SAST in the pipeline, a named reviewer and a release gate that blocks.

How do I set up an application security program for a startup?

An application security program fits security into your delivery: SDL stages, review gates, named owners, developer training and metrics a startup can sustain.

What does CERT-In actually require?

CERT-In's 2022 directions are short but wide: 6-hour breach reporting, 180-day logs, an ISMS and empanelled audits. Here is what each one means.

What is the IT Act 2000 and what does it cover?

The IT Act 2000 is India's foundational cyber law: digital signature, hacking, cheating, and the sections that make an unauthorised access reportable in India.

What is section 66 of the IT Act?

Section 66 is India's central hacking offence. Here is what it covers, the mens rea it needs, the punishment it carries, and how it differs from a civil claim.

What is section 43 of the IT Act?

Section 43 gives an Indian business a civil claim for loss caused by unauthorised access to its system. Here is how the claim is built and what it recovers.

What are the DPDP Rules and what changed?

The DPDP Rules 2025 turn the 2023 Act into daily compliance work: consent notices, data principal rights, breach notification and grievance handling, in stages.

Do I need a Data Protection Officer under DPDP?

Not every Indian company needs a full-time DPO. Here is the significant data fiduciary test, the three-limb role, and when a part-time owner is enough.

What is a data breach notification?

A data breach notification tells the regulator and the affected people what happened. Here are the 72-hour and 6-hour clocks, the content, and a template.

What is the DPDP Act cyber security audit?

The DPDP Rules require significant data fiduciaries to have an independent cyber security audit. Here is who may conduct it, what it covers, and how often.

What is data classification and why does it matter?

Data classification sorts your data by sensitivity so controls, retention and masking follow the data. Here is a workable scheme for an Indian company.

What is ISO 27001 and do we need it?

ISO 27001 is the global information security management system standard. Here is what certification means, what it costs in India, and when you need it.

What is SOC 2 and is it necessary?

SOC 2 is an AICPA attestation against five trust services criteria, not a certification. Here is what a Type I and Type II report mean for an Indian vendor.

What should I do in the first hour of a cyber incident?

The first hour decides whether a cyber incident stays small. Here is the hour-by-hour sequence for an Indian business, from isolation to the 1930 helpline.

How do I report a cyber crime in India?

India has one portal and one helpline for cyber crime. Here is how to file on cybercrime.gov.in, when to call 1930, and how to get an FIR registered.

How long does incident response take?

Incident response runs in four phases with very different clocks. Here is the honest timeline for containment, eradication, recovery and reporting in India.

What is an incident response plan?

An incident response plan decides, before the pressure, who does what. Here are the sections an Indian business needs, from roles to DPDP notifications.

How do I get my money back after a bank fraud?

Getting money back after a bank fraud depends on speed, not luck. Here is the hour-by-hour path, from the 1930 helpline to the bank's own reversal window.

What is a ransomware incident playbook?

A ransomware playbook fixes the kill-switch decision, the isolation points and the restoration order before the attack. Here is what a working one contains.

How do I prove my data was stolen?

Proving exfiltration takes logs, a forensic report and a clean chain of custody. Here is the evidence Indian regulators, banks and courts will actually accept.

What is digital forensics?

Digital forensics recovers and proves what happened on a device or network. Here is the imaging, chain of custody and reporting process we follow in India.

How do I recover a hacked account?

Regaining a hacked email or phone account means revoking sessions, rotating keys and rebuilding trust. Here is the order that actually works.

What is a cyber business continuity plan?

A cyber business continuity plan says how the business runs when systems do not. Here are the RTO and RPO numbers, offline backups and the real test.

How do I choose an incident response retainer?

An IR retainer is bought for response time, not for a logo. Here is how to compare Indian providers, from SLA terms to a real live call test.

What is phishing and how do I train people against it?

Phishing is how most Indian firms are breached. Here is what it really is, why training beats filters, and how to run a phishing simulation that works.

What is a password manager and should I use one for my email accounts?

A password manager stores and generates strong passwords, and it removes the reuse problem behind most email breaches in India. Here is how to roll it out.

What is multi-factor authentication and why does it fail for email and phone logins?

Multi-factor authentication stops most account takeovers, yet Indian firms still get breached. Here is why MFA fails, from SIM swap to SMS OTP and push fatigue.

What is a passkey and why should I use it for email and banking?

A passkey replaces the password with a device-bound biometric or PIN. Here is how WebAuthn works, why it beats OTP, and what to watch for in India.

What is a SIM swap attack on a phone in India?

A SIM swap moves your phone number to another card and steals your OTPs. Here is how it works in India, how to spot it early, and how to stop it.

What is business email compromise and how do I stop it?

Business email compromise is where an attacker takes over a real inbox and sends believable payment requests. Here is how to spot it, stop it and respond.

What is prompt injection in artificial intelligence systems?

Prompt injection makes an AI system follow an attacker's instructions instead of yours. Here is how direct and indirect injection work, and what stops them.

What is AI shadow IT and how do you find unsanctioned artificial intelligence tools?

AI shadow IT is the unsanctioned AI tools your staff already use. Here is how to find it, what it leaks, and how to set a policy that works in India.

What is the human element in cyber security and how does training reduce social engineering risk?

Most breaches involve a person, not a zero-day. Here is what the human element really covers, from social engineering to error, and what training changes.

What is cyber insurance and what does it cover for ransomware and compliance costs in India?

Cyber insurance in India is narrow. Here is what a policy usually covers, what it excludes, and why ransomware terms get tightened after a claim.

What is a supply chain attack and how do you assess a third-party vendor in India?

A supply chain attack reaches you through a vendor you trust. Here is how it works, why SolarWinds worked, and how to assess a third-party vendor in India.

What is the UPI daily transaction limit in India?

The UPI daily limit in India is Rs 1 lakh for P2P and merchant payments, or 20 transactions in 24 hours. The ceilings, the caps and what to do when blocked.

What is the ATM daily withdrawal limit in India?

ATM daily withdrawal limits in India are set by RBI card rules and bank terms. The 2026 changes, the free count, and what to do when a card is skimmed.

What are the main questions, in one table?

The 169 questions fall into three groups. Service intent means you are ready to buy. Problem intent means something has happened. Comparison and trust intent means you are choosing between vendors and want to disqualify the wrong ones fast.

The AAVETech question library: 169 questions, grouped by what the reader is trying to do
Group	How many	What the reader wants	Where to start
Service intent	22	A price, a scope and a start date	How much does a penetration test cost in India?
Problem intent	20	What to do in the next hour	What should I do in the first 6 hours after a data breach?
Comparison and trust	16	How to choose a vendor you can trust	What questions should I ask a penetration testing vendor?

Which question should I start with?

If you are trying to choose a service, start with the cost question. If you are dealing with something that has already happened, start with your situation. If you are comparing vendors, start with the questions to ask a penetration testing vendor, because that is the check that disqualifies the wrong ones fastest.

Can I browse the questions by letter?

A

Are free security scanners enough for a small business?

C

D

H

I

M

S

W

What are the common questions about the question library?

How many questions are answered here?

Every one of them. Each has its own page, its own direct answer at the top, key takeaways, comparison tables where they help, a visible FAQ, and a specific next action at the end. They are grouped by intent: service questions, problem questions, and comparison and trust questions.

Why is there a separate page for every question?

Because a page that tries to answer four questions answers none of them well. A search engine, and an answer engine quoting a result, both work better when a page has one question, one answer and one canonical URL. One page per question also means nothing competes with anything else.

Who writes these answers?

Each answer is written and reviewed by a named person at AAVETech, and the page says which one. The author, the reviewer and the date the page was last reviewed are all visible on the page rather than hidden in a schema.

Are these answers legal advice?

No. They are general guidance for an Indian context, based on the Information Technology Act, 2000, the CERT-In directions and the Digital Personal Data Protection Act, 2023. Where your situation is specific, get advice on your own facts.

How current is the legal information?

Every page carries a visible as-of date and a last-reviewed date, and both are generated from a single field so they cannot drift apart. The legal pages say which obligation applies to which regulation, because a DPDP Rule 7 notification duty that starts in May 2027 is a different thing from a CERT-In six-hour clock that is already in force.

Still not sure which one applies?

Describe the situation in a few sentences. We will tell you what is actually worth doing, and what is not worth paying for yet.

Request a quote See pricing

Last reviewed: 24 October 2026. Information on this page is general guidance, not legal advice. Prices are indicative bands for a typical scope and are confirmed in a written quote before any work begins.