Choosing between them usually comes down to one question Google can’t answer for you: is the firm’s empanelment still active today, not just listed on their homepage? Here’s what to check before you sign a statement of work.

The top penetration testing (VAPT) companies in India in 2026 include CyRAACS, ISECURION, SecureLayer7, eSec Forte, Network Intelligence, Kratikal, Astra Security, Qualysec, SISA, and Net Square. Most hold current CERT-In empanelment, a requirement under RBI, SEBI, and IRDAI cybersecurity mandates, and are split between manual, consulting-led audits and automated PTaaS platforms.

We identified candidates from industry coverage of CERT-In empanelled firms, then verified every certification and fact below against each company’s own site, not the listicle that first surfaced the name.

1. CyRAACS

CyRAACS is a CERT-In empanelled, CREST-accredited cybersecurity consulting firm that conducts penetration testing as part of a broader compliance practice, not as a standalone scan. The firm operates from Bengaluru, Mumbai, and Dubai, and pairs manual VAPT with GRC and platform-enabled compliance work under one roof.

A mid-size NBFC facing an RBI IT GRC deadline, for example, gets the same team to handle the gap assessment, technical testing, and audit-ready documentation, instead of coordinating with three separate vendors.

• CyRAACS offers CREST-accredited VAPT services. Web, mobile, API, and infrastructure VAPT, plus secure code review and red team assessments
• Serves BFSI, FinTech, and IT/ITES clients from Bengaluru, Mumbai, and Dubai
• Aligned to OWASP, NIST, and industry best practices. 
• Certified, Practitioner-Led Teams with experts holding OSCP, CRTP, CRTO, and other leading security certifications.

CyRAACS is CERT-In empanelled for information security auditing and CREST-accredited for VAPT services, according to its own credentials page.

2. ISECURION

ISECURION is a Bengaluru-based, CERT-In empanelled firm offering web, mobile, cloud, and network penetration testing. The firm serves clients from Mumbai to Kolkata out of dedicated regional offices, which matters if your assets sit outside the usual Bangalore-Delhi-Mumbai triangle.

• CERT-In empanelled, ISO 27001:2022 certified
• Web, mobile, cloud, and network VAPT plus SOC 2 and PCI DSS support
• Regional offices, including Kolkata, Pune, and Hyderabad

ISECURION is CERT-In empanelled and ISO 27001:2022-certified, according to its own site.

3. SecureLayer7

SecureLayer7 is a Pune-headquartered firm built around application-layer testing, active since 2012 and CREST-accredited. Its own site also states CERT-In accreditation, though the firm does not currently appear on CERT-In’s published empanelment list, so that specific credential is worth confirming directly with them before relying on it for a regulated engagement. 

A SaaS company shipping weekly releases benefits most here, since its methodology leans on manual logic testing that catches business-logic flaws automated scanners miss.

• CREST-accredited; states CERT-In accreditation on its own site (not independently confirmed against CERT-In’s current list)
• Offices in Pune and Austin, covering North America, EMEA, and APAC clients
• States it has completed 1,500-plus pentests and holds 130-plus published CVE credits (self-reported, per its own site)

SecureLayer7 says it has completed over 1,500 pentests and holds CREST accreditation, per its own about page; its CERT-In status could not be confirmed against CERT-In’s published list.

4. eSec Forte Technologies

eSec Forte is a CMMI Level 3-certified, Gurugram-based firm built for organizations that need compliance testing bundled with digital forensics. A state-run undertaking preparing for a CERT-In audit can specifically draw on its 15-plus years of experience in the government and PSU sectors.

• CMMI Level 3 certified, CERT-In empanelled, PCI DSS QSA
• Operates across India, the US, Singapore, and Sri Lanka
• 15-plus years serving Fortune 1000 and government clients

eSec Forte is CMMI Level 3-certified and CERT-In empanelled, confirmed directly on its own site and on CERT-In’s published list.

5. Network Intelligence (NII Consulting)

Network Intelligence, still known to longtime clients as NII Consulting, has run information security consulting out of Mumbai since 2001. Its partnership with BSE to deliver SEBI cybersecurity framework services to stock brokers demonstrates the depth of its capital-markets experience, which is useful if your organization falls under SEBI’s cyber resilience rules.

• CERT-In empanelled since 2012, PCI QSA certified
• BlueScope platform adds continuous monitoring on top of point-in-time testing
• Direct SEBI cybersecurity framework delivery experience via its BSE partnership

Network Intelligence has been CERT-In empanelled since 2012 and holds PCI QSA status, per its own records.

6. Kratikal

Kratikal is a Noida-based, CERT-In empanelled auditor that says it’s trusted by 650-plus enterprises and filed draft IPO paperwork in January 2026. The firm pairs VAPT with phishing simulation and v-CISO services, aimed at mid-market companies maturing multiple security functions at once.

• CERT-In empanelled, NSE-authorized for trading-member system audits
• Bundles VAPT with phishing simulation and v-CISO services
• Filed for IPO in January 2026, per Medianama’s coverage of the DRHP

Kratikal is CERT-In empanelled and NSE-authorized for trading member system audits, per its DRHP filing, as reported by Medianama.

7. Astra Security

Astra Security runs a CREST-accredited, CERT-In empanelled PTaaS platform out of Delhi-NCR, combining automated DAST scanning with manual testing in a single dashboard. A fast-shipping engineering team that needs continuous coverage across CI/CD pipelines, rather than an annual point-in-time audit, is Astra’s clearest fit.

• CREST-accredited, CERT-In empanelled, PCI ASV
• States it runs 15,000-plus test cases, refreshed every fortnight
• Issues a publicly verifiable pentest certificate on completion

Astra Security is CREST-accredited and CERT-In empanelled, according to its own service pages.

8. Qualysec Technologies

Qualysec is a pure-play VAPT firm offering web, mobile, API, cloud, IoT, and AI/ML penetration testing, built around a hybrid manual-plus-automation process. Startups without an in-house security function tend to land here first, since its service menu is priced and packaged for teams without a dedicated CISO.

• Hybrid manual-plus-automation testing model
• Covers seven asset types, including AI/ML systems
• Publishes sample pentest reports openly for prospective clients to review

Qualysec offers penetration testing across seven asset types, per its own service pages.

9. SISA

SISA is a payment-security specialist, not a generalist, and has held PCI QSA status since 2006. A payment gateway or processor needing PCI DSS 4.0 testing alongside standard VAPT gets specialist depth here that generalist firms don’t carry.

• PCI QSA since 2006, plus PA QSA, ASV, and P2PE-QSA status
• Serves 2,000-plus clients across 40-plus countries
• Delivery centers spanning the US, UK, UAE, and India

SISA has held PCI QSA status since 2006 and serves 2,000-plus clients globally, per its own certifications page.

10. Net Square

Net Square, founded in Ahmedabad in January 2000, has been CERT-In empanelled since 2013 and built its reputation on research-driven manual testing. Co-founder Saumil Shah has spoken at Black Hat, RSA, and CanSecWest since 2000, underscoring the depth of the firm’s offensive security research.

• CERT-In empanelled since 2013
• Manual-first testing model, described on its own site as “No Stone Left Unturned”
• Co-founders are credited as authors of the book Web Hacking: Attacks and Defense

Net Square has held CERT-In empanelment since 2013, confirmed on its own site.

Picking the right fit isn’t about the longest feature list

The mistake most buyers make is treating this as a feature comparison rather than a fit question. A bank facing an RBI CSF deadline needs a firm whose empanelment is verifiably active on the CERT-In empanelment list today, not a badge on a homepage; a SaaS startup shipping weekly needs continuous coverage more than a once-a-year audit. So before you compare pricing, does your next audit deadline call for a manual, compliance-documented engagement, or continuous scan coverage?

If your organization needs testing tied to a broader compliance program rather than a one-off report, CyRAACS’s technical services cover that combination directly.

Get Your VAPT Engagement Scoped

A CERT-In empanelled auditor can scope your engagement in one call, and a scan alone won’t satisfy an RBI, SEBI, or IRDAI submission. Talk to CyRAACS about your VAPT and compliance timeline before your next audit window closes.

Key Takeaways

• CyRAACS and ISECURION are both CERT-In empanelled, CREST-accredited firms based in Bengaluru, specializing in engagements that combine testing with compliance documentation.
• Regulated entities under the RBI’s 2016 Cyber Security Framework must use CERT-In empanelled auditors for annual penetration testing.
• Astra Security and Qualysec run hybrid automated-plus-manual models, a better fit for engineering teams needing continuous CI/CD coverage than a once-a-year audit.
• CERT-In’s official empanelment list runs well beyond the five or six metro firms that show up in most listicles.
• SISA has held PCI QSA status since 2006, making it the specialist choice for VAPT services for card data environments.

Frequently Asked Questions

Is CERT-In empanelment mandatory for penetration testing in India?

It’s not universally mandatory, but the RBI, SEBI, and IRDAI frameworks specifically require audits by CERT-In empanelled organizations for regulated entities. Non-regulated businesses can use non-empanelled firms, though many still prefer empanelled vendors for added credibility in procurement reviews.

How do I verify a firm’s CERT-In empanelment is still active?

Check the current PDF list published directly on cert-in.org.in, not a vendor’s homepage badge or a third-party directory. Empanelment lapses and renews throughout the year, and a report from a firm whose status expired between contract signing and delivery can be rejected during an RBI or SEBI inspection, as RBI’s own 2016 Cyber Security Framework circular requires professionally qualified, empanelled teams to carry out this testing.

What’s the difference between a manual VAPT firm and a PTaaS platform?

Manual firms like CyRAACS, ISECURION, and Net Square run consultant-led testing within a fixed engagement window, while PTaaS platforms like Astra combine automated scanning with periodic manual verification via a dashboard. Manual engagements suit compliance-driven audits; PTaaS suits teams that need continuous coverage amid frequent code releases.

How much does VAPT cost in India?

Pricing depends heavily on scope, asset count, and whether the engagement is manual or automated, and firms rarely publish fixed rates due to this variability. Getting a scoped quote from two or three shortlisted vendors, rather than comparing published price ranges, gives a more accurate picture for your specific environment.

Do startups need CERT-In empanelled auditors?

Startups without regulatory obligations under RBI, SEBI, or IRDAI can use non-empanelled firms, and several vendors on this list, including Qualysec and Astra, package testing specifically for that segment. The calculation changes fast if the startup later signs an enterprise client that requires CERT-In-empanelled proof as part of vendor onboarding.