Ten questions to ask before you hire a VAPT company in India, from CERT-In empanelment and tester credentials to reports, retests and pricing.
Start with your requirements
Before you speak to vendors, write down why you need testing: a customer questionnaire, a regulator, a tender, an audit or internal risk. The reason determines whether you need a CERT-In empanelled auditor, which frameworks the report must map to, and your deadline.
Ten questions to ask
1. Are you CERT-In empanelled, and can you share the reference? 2. Who will actually test, and what certifications do they hold? 3. How many days of manual testing are included? 4. Which methodology do you follow? 5. How do you test business logic and access control? 6. Can we see a sample report? 7. Is the retest included and how long is the retest window? 8. Will the report map to our frameworks? 9. How do you handle testing in production? 10. What happens if you find a critical issue during testing?
Red flags
Quotes that are dramatically lower than others without explanation. Reports that are mostly scanner output. No named testers. No retest, or retests charged at full price. Vague answers on methodology. Pressure to sign before scoping.
Making the decision
Compare vendors on manual effort, tester quality, reporting and retest terms, not only price. Scantra Security is a CERT-In empanelled VAPT company based in Mumbai, with a free retest in every engagement and a sample report available on request.