How do you verify an ethical hacker is legitimate in India?
Key takeaways
- Check the GST registration against the legal name on the invoice, because security testing attracts 18% GST and an unregistered vendor cannot issue a compliant invoice.
- CERT-In publishes a list of empanelled audit agencies, and any empanelment claim must be verifiable on that list rather than on the vendor's own website, which is one of the 8 checks.
- A registered address that is a mail-forwarding service or a coworking desk is a warning sign, particularly for a firm claiming to run an in-house testing lab, and it is one of the 8 checks that costs nothing.
- Ask for a redacted sample report containing real reproduction steps; a vendor who cannot produce a usable sample is selling something other than a test.
- Any request to access a system you do not own, or a refusal to sign a rules-of-engagement document, is disqualifying under sections 43 and 66 of the IT Act, 2000.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What can you check yourself, without spending money?
Eight checks, most of them free and public. One: the GST registration, pulled from the GST portal by GSTIN, matched against the legal name on the invoice and the name on the website. Two: CERT-In empanelment, searched on CERT-In's own published list of empanelled audit agencies, because a firm claiming empanelment for a service it is not empanelled for is a common pattern. Three: the registered address, checked as a real office rather than a mail-forwarding service or a virtual desk. Four: a redacted sample report, offered without hesitation. Five: a named methodology, such as PTES or OWASP ASVS. Six: the tester-day allocation, with the automated share named. Seven: a fixed price, GST shown as a separate line, and a retest policy. Eight: a willingness to sign a rules-of-engagement document, which is the test most people skip.
How do you check CERT-In empanelment properly?
On CERT-In's own published list, and only there. The list names empanelled audit agencies and, in some cases, the specific audit categories each is empanelled for, so check that the category matches the service you are buying. Two mistakes are common. The first is trusting a certificate image the vendor sends you, because a PDF is trivially forged and the certificate number must be traceable to the list. The second is assuming empanelment means the firm is good at everything. Empanelment is a baseline of competence, audit process and reporting, not a guarantee of a particular tester. If your customer requires an empanelled auditor, or your work is a statutory audit, that is when it becomes mandatory rather than optional.
What should you look for in a sample report?
Three things, in this order. First, reproduction steps: a numbered sequence a developer can follow from a clean browser, with the exact request, the role used and the observed response. If the report says a request was crafted but does not show it, the finding cannot be fixed and the report is decoration. Second, evidence: screenshots, request and response pairs, logs, file contents, an actual payload and an actual outcome. Third, impact in business terms, because a finding described as critical because of CVSS is useless to a business owner, whereas a finding described as a staff member reading another tenant's Aadhaar and bank details is not. Also look for the absence of jargon-heavy filler and the presence of a specific remediation that names the code or the configuration.
What are the disqualifying red flags?
Six. A price that arrives by return email with no questions about your systems, roles or endpoints. A complete web application assessed and reported in 48 hours. No sample report, no methodology and no answer about manual effort. A CERT-In empanelment claim you cannot find on CERT-In's list. A refusal or reluctance to sign a rules-of-engagement document, or an offer to start without a signed scope. And any request that involves a system you do not own, or an offer to recover a password, an account or a device belonging to someone else. That last one is not a style question: it is the offence described in sections 43 and 66 of the IT Act, 2000, and a vendor who raises it casually is telling you what you are buying.
| Check | Where to look | What failure looks like |
|---|---|---|
| GST registration | GST portal, matched to invoice legal name | A mismatched or missing GSTIN |
| CERT-In empanelment | CERT-In published agency list | A claim with no matching entry |
| Registered address | MCA public records | A mail-forwarding or virtual desk address |
| Sample report | Request from the vendor | Tool output and no reproduction steps |
| Methodology | Proposal and scope document | No named methodology |
| Tester-day allocation and retest | Pricing proposal | A per-page price with no day count, or a retest at a new rate |
What are the frequently asked questions?
Get a straight answer on this
Send us the company name and GSTIN of the vendor you are checking, and we will tell you exactly what to verify and where to verify it.
Send us the details See pricing