Penetration Testing in Mumbai · Scenario-led, BFSI-grade

Mumbai BFSI clients increasingly draw a hard line between a CERT-In format annual VAPT (a regulator-driven scope) and a true penetration test (a scenario-led adversary engagement scoped against a defined business objective). Macksofy runs both — but the Mumbai penetration testing engagement is different in three concrete ways. First, the kickoff opens with a single objective written by the CISO and the audit-committee chair: 'reach the SWIFT gateway from a guest Wi-Fi position without SOC detection by D+10', or 'mint balance in a test customer's NEFT corridor without tripping the velocity engine'. Second, scope is asset-blind — we get the objective and the rules of engagement, not a fixed asset list. Third, the success metric is not a CVSS roll-up but whether the objective was met, by what path, in how many hours, with how many missed SOC alerts.

The Macksofy Mumbai bench is OSCP and OSEP-credentialed end-to-end. Senior leads carry OSCE3 or OSEP plus at least one CRTO / Red Team Ops II. We work the BKC corridor, Lower Parel, Powai, Andheri MIDC, Goregaon SEEPZ and the Navi Mumbai BCP belt at Airoli / Ghansoli / Vashi the same way: physical assessment legs included in scope where the objective demands it (badge-clone testing in the BKC tower lobby, Wi-Fi war-walking the Lower Parel rooftop, USB-drop on the Powai cafeteria floor). Most engagements include at least one onsite leg with the white-cell coordinator in the room.

Initial-access tradecraft on a Mumbai BFSI pentest typically lands on one of four vectors. Spear-phish against treasury and trade-finance functions is the highest-yield in our experience — the email lure is calibrated against BSE / NSE clearing-cycle news so the click rate is realistic for the audit committee. Watering-hole compromises against vendor-portal logins (Tata Communications, Sify, Tata Tele, Wipro DSP) are second. Physical access via tailgating a BKC tower lobby is third. Public-facing exploit chains — most often via a misconfigured Citrix NetScaler, Pulse Secure or Fortinet appliance — are the fourth lane. Every initial-access path is reproduced into a one-page narrative for the board pack with screenshot, timeline and the operator console reference for the SOC tabletop.

Post-exploitation on a Mumbai bank is a domain-and-identity exercise. ADCS misconfiguration paths (ESC1, ESC4, ESC8) are the single most common privileged-escalation vector across our 2025 engagement set. Kerberoasting against legacy mainframe-RACF integration accounts is the second most common. Constrained-delegation abuse and SCCM relay-to-domain-admin are third. We pull BloodHound paths against the AD forest backing core banking, then map the shortest unauthenticated edge to the SWIFT gateway, the OMS, the RBI WSS connection or the treasury-management system as the objective demands. SOC deconfliction runs through a private bridge — every escalation tagged so the SOC's regression hunt is not noise.

Detection-engineering is part of every Mumbai pentest deliverable, not a follow-on retainer. Every successful step in the kill chain is paired with the Sigma rule, the Splunk SPL or the Sentinel KQL that would have caught it, and a missed-alert reconciliation against the bank's SIEM. Most Mumbai engagements close with 6-12 fresh detection content items the SOC ships into production inside two weeks. For tier-1 private banks, a paired Macksofy detection-engineering analyst sits with the SOC for the closing week of the engagement.

Mumbai listed enterprises (pharma in Powai, FMCG in Andheri, listed manufacturing) buy penetration testing for a different reason — quarterly board-pack assurance and pre-IPO / pre-M&A diligence. The same playbook applies but the executive summary lands as a quarterly trend on the audit committee deck, not a one-off binder. Pharma and IT-services parent-company control catalogues (US BSA / FCPA / SOX overlays) get crosswalked into the report so the parent's IA function has no rework.

Procurement on a Mumbai pentest closes through the CISO and the audit-committee chair, with the General Counsel signing the rules-of-engagement letter for trespass-and-deception waivers, physical assessment indemnity and the safe-harbour clause that lets us touch production. Reports are encrypted, double-key delivered (Macksofy senior + CISO), and the master is destroyed inside 30 days of closure unless the bank requests retention. Mumbai counsel typically wants a Bombay High Court jurisdiction clause and an explicit no-data-exfiltration acknowledgement — both standard in our Mumbai engagement letter.

Onsite cadence is dictated by Mumbai geography (BKC walk-in same day, Andheri MIDC and Powai inside four hours, Navi Mumbai inside six hours) and the bank's BCP site location (Mahape, Airoli, Ghansoli for most clients). Engagement length is typically 4-6 weeks — 1 week reconnaissance, 2-3 weeks active exploitation, 1 week reporting and SOC tabletop. We do not run the standard 2-week 'pentest' that other Mumbai vendors brand under the same name — it does not give the SOC enough time to react and learn.