Penetration testing services in Kolkata

Scoping starts with an asset inventory and a threat conversation. A public marketing site, a customer portal holding personal data and an internal finance application deserve different depths of testing, and paying the same rate for all three wastes budget.

Web application and API testing follows the OWASP Web Security Testing Guide and is checked against the OWASP Top 10:2025, where broken access control, security misconfiguration and software supply chain failures now lead the list. Mobile testing follows the OWASP Mobile Application Security guidance across the client, the storage layer and the backend.

Network testing covers external perimeter and internal segments, including authenticated internal testing that simulates a compromised laptop, which is a far more realistic starting point than an anonymous internet attacker.

Automated scanning is the first ten per cent of the work. It finds outdated components and obvious misconfiguration, and it cannot find the flaws that actually cost money: one user reading another user record by changing an identifier, a price recalculated on the client, a coupon that can be replayed, or a workflow step that can be skipped.

Those are business logic and authorisation flaws, and finding them requires a tester who understands what your application is for. We test with multiple accounts at different privilege levels precisely so horizontal and vertical access control can be probed properly.

Testing methodology draws on the Penetration Testing Execution Standard and NIST SP 800-115 for structure, so coverage is repeatable rather than dependent on one tester having a good week.

Each finding includes the affected component, reproduction steps a developer can follow, evidence, business impact in plain terms, a CVSS rating for consistency, and a specific remediation recommendation rather than a link to a generic article.

The report opens with an executive summary that a non-technical director can read in five minutes, because the person approving the remediation budget is rarely the person who will write the fix.

A retest of remediated findings is included within an agreed window, and the retest letter is what most auditors and enterprise customers actually want to see. Without it you have a list of problems rather than evidence of resolution.

Annual testing supports ISO 27001:2022 technical verification expectations, and card environments need it under PCI DSS. Market intermediaries operate under the SEBI cyber security and cyber resilience framework, which sets expectations around periodic assessment and reporting.

Enterprise procurement teams increasingly ask suppliers for a recent independent test report before signing, so a current test is often a sales asset as much as a control.

All testing is authorised in writing, run within an agreed window with an emergency stop contact, and conducted so that production availability is protected. Denial of service testing is only performed where explicitly requested and separately agreed.