VAPT Services in Mumbai · BFSI & Fintech

Macksofy's flagship VAPT practice operates out of SRA Commercial Tower in Bandra Kurla Complex (BKC), a five-minute walk from the BKC Metro and roughly 1.4 kilometres from RBI's central office at Fort. Every senior consultant on the Mumbai bench is OSCP- or OSWE-credentialed and has shipped at least one annual VAPT cycle into RBI's CSITE Cell, SEBI's Cyber Security and Cyber Resilience Cell, or IRDAI's IT-supervision wing. We do not subcontract — the consultant who scopes the engagement is the one writing the executive summary the bank's audit committee will read.

Mumbai BFSI VAPT scoping is fundamentally a money-movement exercise, not a checklist scan. On a private-bank engagement we model the transaction graph end-to-end: net-banking authentication, OTP/2FA challenge, beneficiary-add flow, IMPS/NEFT/RTGS rails, the FATCA/CRS edge, and the reconciliation layer that ties book-of-record to the SWIFT gateway. Manual abuse-case testing targets velocity-control bypass on the IMPS rail, OTP-reuse via SS7-style mobile-side weaknesses, and reconciliation gaps that allow an attacker to mint balance without minting debit. Burp Suite Pro is the workhorse; Nuclei templates, custom Python harnesses and a fork of mitmproxy handle the protocol-specific abuse.

For SEBI-regulated brokers and AMCs, the scope shifts to broker-terminal authorisation flaws, algo-API rate-limit bypass, market-data tampering on Refinitiv/Bloomberg feed-handlers, and the order-management-to-exchange (OMS-to-NSE/BSE) gateway. The same engagement also closes SEBI CSCRF Annexure-K evidence — CCI/CRMM scoring, MII-vendor-control attestation and the SAR exhibits the System Audit Report demands. IRDAI insurer engagements layer in claims-fraud paths, KYC-impersonation via OVD upload portals, and the policy-administration-system (PAS) authorisation matrix.

The deliverable is a regulator-grade binder, not a Burp HTML export. Every High or Critical finding carries a manually-validated proof-of-exploit, a CVSS v3.1 score, a Macksofy business-impact score calibrated to the bank's transaction value-at-risk, and a remediation playbook that the AppSec lead can hand to engineering without translation. The executive summary is written in the language RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices (November 2023) inspectors expect — explicit clause mapping to Annex-1 of the RBI Cyber Security Framework circular DBS.CO.CSITE.BC.11/33.01.001/2015-16.

Re-testing is built into the SoW, not sold as a follow-on. Every Critical and High finding is re-validated post-fix at no extra cost inside a 60-day remediation window. If the bank's release train slips, we hold the re-test slot — we do not raise a change-order. For tier-1 private banks we also embed a Macksofy detection-engineering analyst alongside the SOC for the last week of the engagement so that every exploitable finding ships with a paired Sigma/Splunk rule the SIEM team can deploy the same week.

Mumbai BFSI procurement reality matters. Most engagements close through a CTO + Chief Risk Officer joint signoff, with the audit committee chair copied; a few cooperative banks still route through the GM-IT and the board-IT-committee secretary. We size proposals to match — a fixed-fee SoW with clear inclusion of re-testing, the empanelled-auditor letter, and the SAR/inspection-defence support that follows. Procurement at listed BFSI clients also wants the SOC 2 / ISO 27001 vendor-security questionnaire pre-answered; we attach the Macksofy ISMS pack to every Mumbai proposal so legal and infosec don't hold up the PO.

Onsite cadence is dictated by Mumbai geography, not vendor convenience. BKC and Lower Parel are walk-in same-day; Andheri MIDC, Powai, Goregaon SEEPZ, Thane and Navi Mumbai (Airoli, Vashi, Ghansoli) are reachable inside four hours including a Western Express Highway buffer. We block the Mumbai monsoon window (mid-June to mid-September) for testing-only weeks where onsite is non-critical, and front-load kickoff/exit calls for the dry months so the audit committee schedule is never held up by a flooded approach road.

For listed BFSI clients the engagement also produces the board-pack exhibits the audit committee needs at the next quarterly cyber review: a top-10 risks slide mapped to the bank's existing risk register, a trend-line vs the previous VAPT cycle, an EDR/SIEM coverage delta, and a one-page CEO note that the bank's Company Secretary can drop into the agenda pack without rewrite.