CERT-In empanelled VAPT company
CyberSigma is a CERT-In empanelled information-security auditor. We perform vulnerability assessment and penetration testing (VAPT) across web applications, mobile apps, APIs, cloud and network infrastructure, and issue CERT-In-aligned reports and safe-to-host confirmations that regulators, acquiring banks and government tenders accept. If you need CERT-In empanelled VAPT for an RBI, SEBI or IRDAI obligation, a government RFP, or a customer security review, we scope the engagement, test to the CERT-In methodology, and give you a prioritised, retest-backed closure report.
Who needs CERT-In empanelled VAPT
What we test
Web application, mobile application (Android/iOS) and API penetration testing; external and internal network VAPT; cloud configuration review (AWS/Azure/GCP); and, where required, thick-client and secure code review.
- Grey-box and black-box testing to the CERT-In methodology and OWASP standards
- Business-logic and authentication/authorisation testing, not just automated scanning
- Expert-verified findings with proof-of-concept and remediation guidance
- Free retest to confirm closure and issue the final report
Applicable regulation
CERT-In empanelment underpins RBI cyber-security and IT-audit expectations, SEBI CSCRF, IRDAI guidelines, and most government and PSU security requirements. Empanelled testing plus a safe-to-host confirmation is frequently the gate for public-facing go-live.
How long it takes
What drives VAPT cost
- Number of applications, APIs, mobile apps and network hosts in scope
- Grey-box vs black-box, and whether source-code review is included
- Retest and re-issue cycles, and reporting depth for regulators/tenders
What you receive
What we most often find
- Broken access control and insecure direct object references (IDOR)
- Authentication and session-management weaknesses
- Cloud misconfiguration — public storage, over-permissive IAM roles
- Injection, SSRF and outdated components with known CVEs
See how we’ve done it before
Is your application one bug away from a breach?
Get a free VAPT scope and quote from CERT-In empanelled testers — share your work email and we scope the work this week.
CERT-In VAPT — FAQs
Is CyberSigma CERT-In empanelled?
Yes. CyberSigma Consulting Services LLP is empanelled by CERT-In for information-security auditing services, and issues CERT-In-aligned VAPT reports and safe-to-host confirmations.
Do you provide a safe-to-host certificate?
Yes. On a clean retest we issue a safe-to-host confirmation where your go-live, tender or regulator requires it. It is a CyberSigma-issued attestation of the testing performed, not a third-party certificate.
How much does a web-app VAPT cost?
Cost scales with the number of applications, APIs and hosts, and whether testing is grey-box or includes source-code review. We give a fixed quote after a short scoping call.
How quickly can you start?
Scoping typically takes 2–4 days; testing then runs 1–3 weeks depending on scope. Urgent tender deadlines can be prioritised.
Talk to a CERT-In empanelled tester
Get a fixed VAPT scope and quote this week, with senior testers — not a sales rep. We reply within four business hours.
Book a 20-minute VAPT call →