Based in Delhi NCR
Abbytes is run from Delhi / NCR, so scoping calls, status updates, and report walkthroughs happen in Indian Standard Time and your working hours. Most testing is delivered remotely, with access arranged securely through VPN, a cloud lab, or scoped credentials. If an internal network test needs a different arrangement, we agree it during scoping.
The teams that typically need VAPT in the region include software and SaaS companies, fintech and payments businesses, e-commerce and logistics platforms, edtech and healthtech startups, and enterprises onboarding vendors that must pass security reviews.
What I Test
- Web application penetration testing: websites, portals, and SaaS platforms.
- Mobile application testing for Android and iOS.
- API security testing for REST and GraphQL.
- Network security assessments, both external and internal, using tools such as Nmap and Nessus.
- Cloud security reviews for AWS, including IAM, storage, logging, and container and Kubernetes configuration.
- Source code review and security audits against ISO 27001, OWASP, and CERT-In baselines.
Compliance Drivers for NCR Companies
Most VAPT requests in the region are driven by a requirement rather than curiosity: an enterprise customer's security questionnaire, an ISO 27001 or SOC 2 audit, a sector regulator such as RBI or SEBI, CERT-In's audit expectations, or preparation for the DPDP Rules. If you are not sure which applies to you, the CERT-In guidelines and compliance checklist is a good starting point, and the VAPT guide explains what each type of test delivers.
How the Engagement Works
- Scoping call. We agree the assets, user roles, testing window, and rules of engagement, and I send a fixed quote.
- Access and authorisation. You provide written permission, test accounts, and any IP allow-listing needed.
- Testing. Automated coverage first, then manual testing for the issues scanners cannot find.
- Report and walkthrough call. Every finding comes with severity, proof of concept, impact, and a fix your developers can act on.
- Free retest. Once you have fixed the findings, I verify them and update the report.
What You Receive
- An executive summary for management and a technical section for developers.
- Every finding with a severity rating, proof-of-concept steps, and business impact.
- Remediation guidance specific to your stack, not generic advice.
- A walkthrough call with your team.
- A free retest and an updated report showing which issues are closed.
Pricing
Pricing depends on scope, not location. As a guide, a manual web application test starts around ₹40,000, mobile testing around ₹50,000 per platform, and compliance-grade multi-asset engagements run to several lakhs. I quote a fixed price after scoping, and the retest is included. The cost guide has ranges by test type.
About the Consultant
Engagements are led by Mohd Abdullah Khan, a CEH v12 certified and ISO/IEC 27001:2022 Lead Auditor information security consultant with 3+ years of hands-on offensive security experience. Findings are prioritised by business impact, not by raw scanner output.