VAPT Services in Gurugram · BFSI HQs & GCCs

Gurugram is the corporate headquarters city for India's largest private banks, every major insurer, the biggest fintechs (Paytm, PolicyBazaar, MakeMyTrip-group), and more than six hundred global capability centres anchored in DLF Cyber City Phase 1-5, DLF Cyberhub, Udyog Vihar, Sohna Road and Golf Course Road. The VAPT buyer is almost always a CISO sitting in a DLF Cyber City Phase 3 tower or a Golf Course Road HQ, answering simultaneously to an Indian regulator and an overseas parent's group cyber-risk function. Scopes have to satisfy both audiences in one report cycle or the engagement gets re-run six months later.

On private-bank HQ scopes we deliver VAPT on net-banking, treasury, payment-gateway, partner-API and core-banking estates with the same regulator-grade rigour we use in Mumbai BKC, plus parallel evidence packs aligned to NIST 800-53 rev 5, PCI-DSS v4.0.1, and the parent group's internal cyber-control catalogue (typically a derivative of ISO 27002 with the FFIEC Cyber Assessment Tool layered on top). RBI Master Direction on IT Governance (November 2023) and the RBI Cyber Security Framework Annex-1 close the regulator side; the parent group sees a NIST-CSF mapped crosswalk produced from the same evidence base.

For insurer HQs on Sohna Road and in DLF Cyber City — life, general and health — IRDAI Information & Cyber Security guidelines (April 2023) drive scope: claims-fraud paths, KYC-impersonation portals, agent-onboarding flows, the PAS authorisation matrix and the bancassurance API edge that sits between the insurer and its private-bank partners. Most Gurugram insurers also operate a parent-mandated GRC stack (Archer or MetricStream) and expect evidence drops into that platform on a defined cadence; we ship findings as both a regulator binder and an Archer-importable CSV.

For GCCs in Udyog Vihar, Sector 44, Sector 32 and Golf Course Road, scopes blend an internal-network pentest with a cloud-control review on the parent's AWS or Azure tenant. Most GCC production infrastructure sits offshore but the India-based engineering staff own build, release and break-glass admin access — so the privilege-path between Gurugram engineers and offshore production is the high-value attack surface. We test the BloodHound shortest-path from a Gurugram developer laptop to the parent's production AWS organisation, the ADCS template configuration (ESC1-ESC8) in the India-side AD, and the CI/CD trust chain (GitHub Actions OIDC, Azure DevOps service connections) between Gurugram repos and offshore deploy targets.

Internal-network testing in Gurugram has to account for DLF Cyber City's multi-tenant office reality. 'Corporate LAN' frequently means a shared building backbone with cross-tenant L2 visibility that the bank's network team did not architect for. We run LLMNR/NBT-NS poisoning, IPv6 mitm6, SMB relay and ADCS-misconfig chains against the corporate segment, then explicitly document which findings sit inside the bank's perimeter and which are DLF-backbone artefacts the building-management contract has to resolve. That distinction matters because the audit committee will ask.

Onsite kickoff in Gurugram is next-day from Mumbai BKC — the BOM-DEL morning flight plus the Aerocity-to-Cyber-City drive lands the senior consultant at the client by 11am. For engagements that run beyond two weeks we stage a Delhi-resident lead consultant for the duration so onsite cadence is tight and the bank does not pay flight overhead on every sprint review. Procurement at Gurugram private banks usually runs through the CISO, the CRO and a board-level Cyber Risk Sub-Committee; the audit committee chair signs off on the SoW. Fintechs close faster — CTO + CFO is typical.

Most Gurugram private-bank engagements need stakeholder briefings across two time zones in the same week — the Indian board on Tuesday and the overseas parent's risk committee on Thursday. We build the engagement plan around that cadence and provide pre-read packs the CISO can forward without rework. The same VAPT also routinely feeds a TIBER-EU-style RFP cycle that the parent's group-cyber team is running for the next year's red team, so the evidence base is structured to be portable to that next engagement rather than locked in a one-off PDF.

Where the bank or insurer operates a PCI-DSS scope (card-personalisation, payment-gateway, hosted card-network connectivity), we layer in scope-reduction testing — segmentation validation against the CDE, tokenisation-vault separation and the network controls that justify a SAQ-D-Service-Provider vs SAQ-D-Merchant differentiation. The output reduces the recurring assessment cost in subsequent years, which the CFO notices more than the CISO does.