Penetration Testing in Bengaluru · SaaS, Product & GCC

Bengaluru penetration testing is overwhelmingly a SaaS, product and global-capability-centre (GCC) buyer market — and the difference shows in scope, methodology and report format. The Bengaluru buyer is technical: an AppSec lead, a CTO or a Director of Product Security with one foot inside the engagement, not procurement reading from a checklist. They want manually-validated chained exploits, multi-tenant isolation evidence, IaC-misconfiguration narratives that survive a US-headquartered parent's procurement review, and a deliverable that drops cleanly into the next SOC 2 Type II audit window. Macksofy's Bengaluru bench is wired for exactly this profile.

Manual-first is the headline. Automated scanners (Burp Pro, ZAP, Nuclei) run as supporting infrastructure, never as the deliverable. Every High and Critical finding carries a manually-validated proof-of-exploit with the curl reproduction, the Burp session export and the screenshot timeline. Multi-tenant authz testing exercises tenant-A-as-tenant-B impersonation at every role boundary (BOLA — Broken Object Level Authorisation — is OWASP API Top 10 #1 for a reason) and every tenant-bleed surface — shared file stores, shared search indices, shared inference endpoints, shared LLM context windows, shared queue topics. The methodology defaults to OWASP ASVS Level 3 for product clients and OWASP API Security Top 10 (2023) for API-first scopes.

Cloud-native testing is the second pillar. Most Bengaluru SaaS clients run a hub-and-spoke AWS or GCP account topology, sometimes layered with Cloudflare Workers, Vercel edge functions, or a CDN-side WAF. We exercise IaC misconfiguration (Terraform state exposure, overly-broad IAM Pass Role, S3 bucket-policy ambiguity, KMS key-policy escalation, Lambda execution-role lateral movement), CI/CD pipeline takeover (GitHub Actions OIDC token theft, GitLab CI runner privilege, Buildkite agent compromise), and supply-chain risk (compromised NPM dependency, leaked PAT, an exposed Vault token). Bengaluru product CTOs particularly care about the CI/CD takeover lane because it is the single highest-leverage path into a SaaS estate.

Identity is the third pillar. SAML, OIDC and OAuth 2.0 integration testing is in scope on every Bengaluru engagement — federation with Okta, Auth0, AWS Cognito, Microsoft Entra ID and Google Workspace. We test session-handling, refresh-token-rotation, PKCE enforcement, audience confusion attacks, JWT algorithm confusion, mTLS-bypass and the surprisingly common 'forgot the audience claim' pattern. For B2B SaaS with enterprise customer SCIM provisioning, we exercise SCIM impersonation paths and the directory-API lateral that always seems to exist.

Bengaluru product clients increasingly buy AI / LLM application security inside the same engagement. Prompt-injection (direct + indirect via document RAG), tool-use abuse via injection into agent reasoning, training-data exfiltration via inference-API probing, and the OWASP Top 10 for LLM Applications (2025) cross-mapped to the application's threat model. Most B2B SaaS pentests in 2025 carry at least one LLM-specific finding worth shipping in the executive summary.

The deliverable lands inside the next SOC 2 Type II audit window — that timing is non-negotiable for most Bengaluru buyers. The executive summary maps every finding to SOC 2 CC6, CC7 and CC8 control categories, ISO 27001:2022 Annex A clauses, and (where US healthcare data is in scope) HIPAA Security Rule §164.308-312. Reports are reviewed by AppSec leads line-by-line, so we treat every finding write-up like a code review and ship reproducible exploit code (Python / curl / Burp .req) so the engineering team does not need to translate. The same deliverable doubles as the enterprise-procurement vendor pack for the client's customer-security questionnaires.

Procurement reality matters. Most Bengaluru product companies close the SoW through the CTO, the AppSec lead and the head of customer security in a single weekly sync. There is no formal RFP. Pricing transparency, the methodology document, the lead consultant's GitHub or HackerOne profile and an LOI from the parent company's CISO get the engagement moving inside the same quarter. For Bengaluru GCC clients of US-headquartered Fortune 500s, we work to the US parent's pentest standard (commonly a NIST SP 800-115 v2 derivative) and ship the report in the US parent's preferred template.

Onsite cadence is light by design — Bengaluru engineering teams are async, distributed across Whitefield, ORR, Electronic City, Koramangala and Indiranagar, and weekly stand-ups on Slack or Linear are the actual integration surface. Senior consultants fly Mumbai → BLR for kickoff (often in Manyata, Outer Ring Road or Whitefield) and for the closing readout. The rest of the engagement runs remote with daily async stand-ups and a shared findings tracker (Linear, Jira or GitHub Issues). Most Bengaluru engagements complete in 3-4 weeks.