Web Application Security in Pune · IT Services & Edtech

Pune web-application-security demand is overwhelmingly driven by three buyer segments — IT-services delivery centres in Hinjewadi Phase II / III, edtech and SaaS unicorns in Magarpatta and Kharadi, and connected-vehicle customer apps for Pune-based auto OEMs running connected-car back-ends. Each has a distinct application surface, distinct regulator / parent / customer profile, and demands a distinct methodology stack. Macksofy's Pune AppSec practice runs one bench, three sub-playbooks, with senior consultants flying or driving from Mumbai BKC for kickoff and major reviews — 3 hours by car or 30 minutes by flight.

IT-services delivery-centre AppSec is the volume segment. Hinjewadi Phase II / III delivery centres for Infosys, TCS, Wipro, Cognizant, Capgemini, IBM India, Accenture, Deloitte and the smaller IT-services firms test customer-facing applications they build for US / UK / EU customers. The AppSec engagement closes the customer's third-party-AppSec standard — the US customer's preferred control catalogue (NIST CSF, CIS Controls, parent-specific), the UK customer's CREST CHECK-aligned methodology, the EU customer's TIBER-EU / GDPR overlay. The report drops into the customer's TPRM tool with no rework. For the IT-services major's own internal portal-and-tools estate (HR portal, project-management portal, customer-collaboration portal), OWASP ASVS L3 + ISO 27001:2022 Annex A is the default catalogue.

Magarpatta edtech AppSec is the second sub-playbook. Magarpatta and Kharadi host several edtech unicorns and product-led-growth edtech operators. Test surface covers student-data isolation (the critical authz boundary in any edtech application), age-gating / KYC controls (DPDP minor-consent provisions apply where students are under 18), parent / guardian authorisation flows (consent-to-parent vs consent-from-student), payment-flow abuse paths (subscription fraud, refund-race, payment-intent manipulation), content-delivery DRM bypass and screen-record-resistance, and the AI-tutor LLM surface that increasingly anchors edtech AI products. OWASP ASVS L3 + DPDP overlay + (where applicable) FERPA / COPPA for US-bound student data.

Connected-vehicle customer-app AppSec is the auto-OEM 2026 specialty. Auto OEMs and shared-mobility operators (Pune hosts several connected-car back-ends and shared-mobility apps) need AppSec coverage on the rider-app, the driver-app, the fleet-management portal and the customer-account portal. Test surface includes rider / driver authentication, fraud-stack integration (the rider-side fraud surface is significant in shared-mobility), payment-flow abuse paths, telematics-platform-API consumption controls, customer-data isolation, and (where applicable) the AI-trip-recommendation LLM surface. Findings map onto ISO/SAE 21434 customer-facing-surface controls and (where European customers are in scope) GDPR + UN R155 / R156 customer-data-protection clauses.

Magarpatta / Kharadi SaaS AppSec follows the Bengaluru pattern at platform-level — OWASP ASVS Level 3, multi-tenant authz, identity federation, cloud-native testing, LLM-application surface — with a more Indian-enterprise-customer profile and stronger DPDP overlay than Bengaluru's predominantly US-customer profile. Indian enterprise customers (BFSI, manufacturing, government) tend to ask for CERT-In-aligned reporting alongside SOC 2 CC7 evidence, so we ship both formats from a single engagement.

AI / LLM application security is a Pune 2026 differentiator. OWASP Top 10 for LLM Applications (2025) is the default catalogue for any AI surface in scope across all three sub-playbooks. AI-tutor LLM surfaces for edtech, AI-trip-recommendation LLM surfaces for connected-vehicle / shared-mobility, AI-customer-service-assistant LLM surfaces for SaaS — all are tested with direct + indirect prompt-injection, tool-use-abuse on agent reasoning, training-data exfiltration and the domain-specific impersonation paths each surface exposes.

Procurement reality matters. IT-services delivery-centre AppSec engagements close through the Indian CISO with the US / UK / EU customer's regional security function copied. Edtech AppSec closes through the CTO and AppSec lead, often with the product head copied for consent-flow and parent-authorisation review. SaaS AppSec closes through the CTO and head of customer security. Connected-vehicle customer-app AppSec closes through the IT head and (for OEM scopes) the head of vehicle cyber-security and the customer's regional cyber-security function. Engagement letters align to the customer's third-party-AppSec standard for IT-services delivery work.

Onsite cadence — Mumbai BKC senior consultants drive 3 hours over the Expressway for kickoff and major reviews or fly Mumbai → Pune (30 minutes). Same-day onsite arrival is normal for kickoff at Hinjewadi / Magarpatta / Kharadi. Engagement length is typically 3-4 weeks for SaaS / edtech, 4-5 weeks for IT-services delivery-centre and connected-vehicle customer-app scope. For sustained programmes with weekly release trains, we offer continuous-AppSec retainers with a Pune-resident lead consultant.