VAPT · Hardening · Compliance · Incident Response

The breach you
can't see yet.

Most businesses discover they've been compromised an average of 277 days after the breach actually happened. We help you find and fix vulnerabilities before someone else exploits them — and we're on the phone within an hour if they already have.

277 days · Average time to detect a breach (IBM Cost of a Data Breach 2024)
₹19.5 Cr average cost of a data breach in India (IBM, 2024)
68% of breaches involve a human element — phishing, credential theft, or social engineering
₹250 Cr maximum penalty under India's DPDP Act 2023 for a significant data breach

Cybersecurity isn't a checkbox. It's the difference between a quiet Wednesday and the worst week of your career.

What we do

Six pillars of
real security work.

We don't sell "cybersecurity" as a vague offering. We deliver specific, scoped engagements with named methodologies, deliverables, and timelines. Here's what each pillar actually includes.

01

Vulnerability Assessment & Penetration Testing

Manual and automated testing of your applications, infrastructure, and APIs against the OWASP Top 10, CWE/SANS Top 25, and India CERT-In's framework. Real exploit attempts by certified testers — not just an automated scanner output.

  • Web application VAPT (black-box, grey-box, white-box)
  • Network & infrastructure penetration tests
  • API security testing (REST, GraphQL, gRPC)
  • Mobile app security testing (Android, iOS)
  • Detailed report with proof-of-concept & remediation
  • Re-test included after fixes are deployed
Deliverable: Written report, executive summary, technical findings, remediation guide. Typical turnaround: 2-4 weeks.
02

Web Application & WordPress Hardening

If your business runs on WordPress, WooCommerce, Magento, or a custom stack, we lock it down — file permissions, plugin auditing, admin protection, malware cleanup, and ongoing monitoring.

  • WordPress / WooCommerce / Magento hardening
  • Malware scan, removal, blacklist recovery
  • Plugin & theme vulnerability auditing
  • Login protection (2FA, IP allow-listing, brute-force lockout)
  • Database & file integrity monitoring
  • SSL/TLS configuration audit (A+ on SSL Labs target)
Deliverable: Hardened install, configuration documentation, monthly monitoring reports.
03

Infrastructure & Server Hardening

From Linux server hardening to enterprise-grade DDoS protection. We work the way attackers do — closing every door before they find it.

  • Linux / Windows server hardening (CIS benchmarks)
  • Firewall & iptables / firewalld configuration
  • Web Application Firewall (WAF) deployment
  • DDoS protection (Cloudflare Pro/Business tier integration)
  • Intrusion detection & prevention (IDS/IPS)
  • Log monitoring & SIEM integration
Deliverable: Hardened infrastructure, configuration baseline, alerting rules, runbooks.
04

Email Security, Anti-Phishing & MFA

Email is still how 90% of breaches start. We fix the technical layer (SPF, DKIM, DMARC) and the human layer (training, phishing simulations, MFA enforcement).

  • SPF, DKIM, DMARC configuration & reporting
  • Anti-phishing & spoofing protection
  • MFA / 2FA rollout across Google Workspace, M365, custom apps
  • Phishing simulation campaigns & staff training
  • Password policy & breach-monitoring (HaveIBeenPwned integration)
  • Conditional access & SSO setup (Okta, JumpCloud, Azure AD)
Deliverable: Locked-down email, trained staff, measurable phish-resistance scores.
05

Compliance Readiness

The DPDP Act 2023 is now the law. ISO 27001 and SOC 2 are increasingly required by enterprise customers. We get you audit-ready — not just check-the-box ready.

  • DPDP Act 2023 — gap analysis, consent flows, DPO documentation
  • ISO 27001 — Stage 1/Stage 2 audit readiness, ISMS documentation
  • SOC 2 Type I & Type II — control mapping, evidence gathering
  • PCI DSS — card-data scope reduction, SAQ guidance
  • HIPAA — for healthcare clients with US patient data
  • Vendor & supply-chain security questionnaires
Deliverable: Audit-ready documentation, policy library, evidence repository, mock audit.
06

Incident Response (Active Breach)

If you've been hacked, every hour matters. Our incident response team commits to first-response within 60 minutes, 24/7, for retainer clients. Pay-as-you-go incident response is also available — though we strongly recommend retaining us before you need us.

  • 1-hour first-response SLA for retainer clients
  • Containment, eradication, recovery
  • Forensic analysis & root-cause investigation
  • CERT-In incident reporting (mandatory in India)
  • Communications support (customers, regulators, press)
  • Post-incident report with hardening recommendations
Deliverable: Restored systems, forensic report, regulator filings, lessons-learned debrief.
Frameworks & standards

The standards we test against.

We don't make up our own methodology. We work against published, peer-reviewed frameworks — so our findings hold up to any auditor's scrutiny.

OWASP Top 10

Industry-standard list of the most critical web application security risks. Every web app we audit is scored against the latest OWASP Top 10.

OWASP ASVS

Application Security Verification Standard — three rigor levels (L1, L2, L3) for verifying the security posture of an application.

CWE / SANS Top 25

The 25 most dangerous software weakness types, maintained by MITRE and SANS. Used in our code-level reviews.

NIST CSF

NIST Cybersecurity Framework — Identify, Protect, Detect, Respond, Recover. Our assessment structure mirrors this.

CIS Benchmarks

Configuration baselines for Linux, Windows, Kubernetes, Docker, AWS, and more. We harden infrastructure to CIS Level 1 or 2 depending on scope.

CERT-In Guidelines

India's national CERT framework, including the 6-hour incident reporting mandate. We integrate this into all retainer-client runbooks.

ISO/IEC 27001:2022

The international standard for Information Security Management Systems. We prepare clients for Stage 1 and Stage 2 audits.

DPDP Act 2023

India's Digital Personal Data Protection Act. We help businesses implement consent, retention, breach notification, and DPO frameworks.

How an audit runs

Four phases.
No surprises.

A typical security audit takes 2-4 weeks. Larger or compliance-driven engagements run 6-12 weeks. Either way, the process is the same.

01

Scoping & rules of engagement

We sign a mutual NDA, define exactly what's in scope (which apps, which IP ranges, which data classes), agree on test windows so we don't disrupt production, and document the rules of engagement in writing. No testing happens until this is signed.

02

Reconnaissance & discovery

Passive and active reconnaissance — open ports, exposed services, technology fingerprinting, public data leakage, third-party dependencies. We build the same map an attacker would, before testing anything.

03

Active testing & exploitation

Manual exploit attempts against discovered surface area. Where vulnerabilities are found, we attempt safe proof-of-concept exploitation to confirm impact — never destructive, never data-exfiltrating beyond what's needed to prove the finding. Daily status updates throughout.

04

Reporting, remediation & re-test

Detailed written report: executive summary, CVSS-scored findings, proof-of-concept screenshots, exploitation walkthrough, business impact, prioritized remediation steps. After your team fixes the issues, we re-test (included in scope) to confirm closure. Final clean report goes to your auditor or board.

How to engage us

Three engagement models.

Pricing is custom-quoted based on scope and complexity. The models below describe the shape, not the cost.

Incident response

Already breached? Call now.

If you suspect or have confirmed a security incident, time matters more than anything else. Detection-to-containment is the single biggest predictor of total breach cost.

Retainer clients get a 1-hour first-response SLA, 24/7. Non-retainer emergency response is available on a best-efforts basis at premium rates — typically same-business-day during India business hours.

<1hr First-response SLA
(retainer clients)
24/7 Active monitoring
India + Singapore
6hrs CERT-In reporting
handled by us
Tooling

The tools we use.

A mix of commercial, open-source, and proprietary tooling. We're transparent about what we use because it's easy for clients to verify.

VAPT & scanning

  • Burp Suite Professional
  • Metasploit Framework
  • Nmap, Nessus, OpenVAS
  • OWASP ZAP, Nikto
  • SQLMap, Wfuzz, FFuf
  • MobSF (mobile)

Infrastructure

  • Cloudflare WAF & Bot Mgmt
  • Fail2Ban, CrowdSec
  • iptables / firewalld / ufw
  • Wazuh (SIEM)
  • OSSEC (HIDS)
  • Lynis (CIS auditing)

Email & identity

  • DMARC analyzers (Postmark, Valimail)
  • Have I Been Pwned API
  • KnowBe4 / Hoxhunt (phishing sims)
  • Google Workspace / M365 admin
  • Okta, JumpCloud, Azure AD
  • YubiKey, Google Authenticator

Compliance & GRC

  • Drata, Vanta (SOC 2 / ISO)
  • Sprinto (DPDP / ISO)
  • OneTrust (privacy)
  • Custom evidence repositories
  • Policy templates (CIS, ENISA)
  • Internal audit checklists
Industries we know

Where we've done deep work.

Cybersecurity isn't industry-agnostic. Different verticals have different threat models, regulatory regimes, and risk tolerances. These are the spaces where we have repeat experience.

E-commerce & retail

PCI DSS scope reduction, payment-page security, fraud prevention, account takeover defense, Magento & WooCommerce hardening.

Fintech & lending

RBI cybersecurity framework alignment, NPCI / UPI security, KYC data protection, transaction integrity, audit-trail systems.

Healthcare & healthtech

HIPAA (US clients), patient-data encryption, telemedicine session security, hospital network segmentation.

SaaS & B2B

SOC 2 Type II readiness, multi-tenant isolation, customer-data segregation, vendor security questionnaires.

Education & edtech

Student data protection (DPDP, COPPA for US), exam-platform security, video-class privacy, parent-portal access controls.

Hosting & SaaS infra

This is our home turf. We run our own hosting brands (99RDP, OliveVPS) and apply the same security to client infrastructure.

Global delivery

India and Singapore
delivery centers.

Our Indian parent (Amaze Internet Services Pvt. Ltd.) handles domestic and South Asia engagements. Our Singapore subsidiary, QNET Datacenter Pte. Ltd. (UEN 202451839D), is registered for cybersecurity consultancy under SSIC 62022 and handles international engagements where the client requires a non-Indian contracting entity for jurisdictional reasons.

Both entities operate under the same engineering team and quality standards. The choice of contracting entity is purely a commercial and compliance matter for the client.

Read more about our group structure
Frequently asked

The questions we get most.

Are your testers certified?

Yes. Our testers hold combinations of OSCP (Offensive Security Certified Professional), CEH (Certified Ethical Hacker), CompTIA Security+, and ISO 27001 Lead Auditor credentials. We're happy to share specific certifications under NDA during commercial discussions.

Will testing disrupt our production systems?

Almost never, by design. Active exploitation is done within negotiated test windows, against pre-agreed scope, with safety stops built in. Where there's any risk to production, we test against a staging mirror instead. The rules of engagement document defines exactly what is and isn't allowed.

How is this priced?

Custom-quoted based on scope, complexity, and engagement model. A typical web application VAPT for an SMB starts at a few lakhs; a multi-quarter compliance program runs significantly more. We don't publish rate cards because cybersecurity scope varies enormously, but we'll share an indicative range within 1-2 business days of the intake call.

Can you help if we're being attacked right now?

Yes. Call +91 9801498292 immediately. Even if you're not a retainer client, we'll triage and either take the engagement or refer you to a CERT-In empanelled responder if the situation requires it. The first 60 minutes of a confirmed breach matter enormously — don't wait.

Are you CERT-In empanelled?

We work alongside CERT-In empanelled auditors for engagements that require the certification (such as some Indian government contracts and certain regulated-industry audits). For most commercial engagements, our internal certifications and frameworks are sufficient. We're transparent about which engagements need CERT-In empanelled sign-off.

What's the difference between VAPT and a security audit?

A security audit is a broad assessment of policies, controls, and configurations against a framework (like ISO 27001). VAPT is a focused, hands-on attempt to find and exploit vulnerabilities in specific assets. You typically need both — the audit tells you what should be in place, the VAPT tells you whether it actually works.

Do you sign retainers with non-disclosure agreements?

Always. Mutual NDAs are signed before any technical specifics are shared. Findings, methodologies, and even the existence of an engagement are confidential by default. Client identities are never published on our marketing.

Can you handle our DPDP Act compliance work?

Yes — gap analysis, consent flow design, retention policy implementation, breach notification procedures, and Data Protection Officer (DPO) documentation. We work with our partner law firms when legal interpretation is required, but the technical and operational work is in our scope.

Find what's broken
before they do.

The first call is a 30-minute confidential conversation — no pitch deck, no scare tactics. Just a direct discussion about your environment, what you're worried about, and whether we're the right fit for the work.

Request a security audit