Cyber security for India's banks, fintechs and hospitals.

Vulnerability Assessment and Penetration Testing. The assessment finds known weaknesses across your applications, APIs, networks and cloud; the penetration test safely tries to exploit them the way a real attacker would, so you know which issues actually matter. You get a report with CVSS-scored findings, proof of concept and fix guidance, plus a retest.

At least once a year, and after any major change such as a new app release, infrastructure migration or new integration. Many regulated entities must test more often — SEBI CSCRF, RBI and PCI DSS each set their own cadence depending on your category. We map the right frequency to your obligations.

It depends on your licence and category — for example an NBFC follows RBI directions, while a stock broker falls under SEBI CSCRF by category. Try our Compliance Finder for an indicative answer, then book a gap assessment for a definitive mapping.

Under the CERT-In Directions of 28 April 2022, organisations in India must report specified cyber security incidents to CERT-In within 6 hours of noticing them. The same directions require 180 days of logs kept within India and clocks synced to approved NTP servers. We build the playbook and help you file the report.

Disconnect affected devices from the network (don't switch them off or wipe them), preserve logs and backups, don't contact or pay the attacker, photograph the ransom note, and call an incident responder. Our emergency page has the full checklist.

Yes. We isolate and forensically image the device first so evidence is preserved, analyse what happened and what data was touched, then clean or rebuild it and restore from clean backups. You receive a report suitable for management, regulators or police.

Yes. We help hospitals, clinics, labs and health-tech firms with VAPT (including medical-device and HIS/PACS exposure), ransomware readiness and recovery, staff training, and alignment with DPDP, ABDM and — for US clients — HIPAA.

A lightweight, recurring security health-check for small NBFCs, clinics, brokers, startups and SMEs, with an A–F scorecard and a prioritised action list. Scope and terms are agreed in writing with each customer — contact us for details.

Call or WhatsApp our emergency line at any time and we start triage on that call. Committed response times are set out in writing in incident response retainers, so you know exactly what to expect before an incident happens.

We work under NDA, share data on a need-to-know basis, keep evidence and reports encrypted, and securely destroy case data at the end of an engagement with a certificate of destruction on request. We never ask you to send suspicious files over email or public forms.