Vulnerability Assessment + Penetration Testing.
VA finds the inventory of weaknesses; PT proves which ones an attacker can actually exploit. Macksofy delivers both as a single engagement, in the format Indian regulators expect.
What is VAPT?
VAPT (Vulnerability Assessment and Penetration Testing) combines automated scanning with manual, expert-led exploitation. The assessment finds weaknesses at breadth; the penetration test proves which are actually exploitable and how far an attacker could reach. Macksofy delivers CERT-In-empanelled VAPT for BFSI, fintech, and SaaS across India and the UAE.
- 48hQuote SLA
- 5–15 daysEngagement
- 30 daysFree retest
- CERT-In readyFormat
VA finds the inventory. PT proves the impact.
A scanner can list 800 vulnerabilities in a day; an attacker only needs one to matter. We do both — then the report only shows you what mattered.
Vulnerability Assessment
Tells you everything that might be wrong.
Penetration Testing
Tells you what an attacker would actually do.
Six phases, every step documented.
Auto-advancing timeline of how a Macksofy VAPT engagement actually runs — pause, rewind or click any phase to drill in.
Scoping & Pre-engagement
Mutual NDA · Rules of Engagement · Crown-jewel identification
Every Macksofy engagement begins with a tight scoping call. We agree on assets in/out of scope, define the Rules of Engagement, identify your crown jewels, and align on success metrics before a single packet leaves our infrastructure.
- Mutual NDA + authorization letter
- Asset inventory + scope freeze
- Crown-jewel and high-impact target identification
- Communications and emergency-contact protocol
Reconnaissance & Threat Modeling
OSINT · ASN mapping · Attack-surface decomposition
Active and passive reconnaissance to map your true attack surface — including assets your IT team has forgotten about. Threat modeling that profiles the actual adversaries your industry faces.
- Active + passive recon (OSINT)
- Subdomain enumeration + ASN/IP range mapping
- Service + version fingerprinting
- STRIDE / PASTA threat decomposition
Exploitation
Manual + tooled · Web · Network · AD · Cloud
Where most reports stop, we begin. Manual exploitation of every High/Critical finding — chained where possible — to demonstrate real business impact. We don't ship Nessus reports.
- OWASP Top 10 + business-logic exploitation
- Buffer overflows, deserialization, RCE chains
- Cloud privilege escalation (IAM, Lambda, K8s RBAC)
- Active Directory attack paths via BloodHound
Post-Exploitation
Privilege escalation · Lateral movement · Persistence
Foothold to full compromise. We pivot, escalate and persist exactly the way a determined APT would — within the rules of engagement — to map the worst-case impact across your environment.
- Linux + Windows privilege escalation
- Kerberos delegation + golden/silver tickets
- Lateral movement: WinRM, WMI, PsExec, smbexec
- Sensitive data access demonstration (no exfiltration)
Reporting
Board-ready · Developer-friendly · Regulator-format
Executive summary your board can read in 5 minutes. Technical detail your engineers can fix in days. Regulator-format sections (CERT-In, RBI, SEBI) that your auditor accepts on the first read — no rework.
- Executive summary (2–3 pages, board-ready)
- Per-finding CVSS 3.1 + business risk + PoC
- Developer-friendly remediation guidance
- MITRE ATT&CK technique mapping
Retest & Sign-off
Free retest · Compliance letter · Purple-team handoff
Once you remediate, we re-test every High/Critical finding free of charge. On closure we issue an auditor-acceptable letter — and where helpful, run a purple-team session so your blue team learns from the engagement.
- Free retest within 30 days of fix submission
- Final closure letter / Macksofy attestation
- Compliance-ready (CERT-In · ISO 27001 · SOC 2 · PCI-DSS)
- Optional purple-team workshop with your defenders
1 · Asset discovery
- External attack surface mapping
- Internal asset inventory reconciliation
- Cloud asset enumeration (AWS / Azure / GCP)
2 · Vulnerability assessment
- Authenticated + unauthenticated scans
- Web app + API scans (Burp Pro, Acunetix)
- Container, IaC, secrets scanning
3 · Triage + validation
- False-positive elimination
- Manual validation of every High/Critical
- Risk re-scoring per your business context
4 · Exploitation (PT)
- Proof-of-concept exploitation
- Chain analysis (low + low = critical)
- Impact demonstration
5 · Reporting (regulator-format)
- CERT-In format, ready for direct submission
- Executive + technical sections
- Risk register update
6 · Remediation + retest
- Developer-ready fix guidance
- Free retest within 30 days
- Compliance closure letter
Every asset class. Every test depth.
A VAPT scope is a 2D matrix: what we test (asset types) × how deep we test (authenticated, manual exploitation, chained). The grid shows what’s included in a Macksofy engagement.
| Asset class \ Test depth | Authenticated scan | Unauthenticated scan | Manual exploitation | Chain analysis |
|---|---|---|---|---|
| External perimeter | manual | manual | ||
| Internal network | scan | manual | manual | |
| Web app + API | manual | manual | ||
| Mobile (iOS / Android) | — | manual | manual | |
| Cloud (AWS / Azure / GCP) | scan | manual | manual | |
| Containers / IaC | scan | manual | — |
Low + low + low is how breaches actually start.
Scanners look at findings one at a time, and one at a time most of them really do look low. Attackers don’t read reports — they chain. Three innocuous misconfigurations stitched together is how an unauthenticated foothold quietly becomes domain admin. We show you that chain, not just the CVSS list.
One engagement. Eight frameworks.
The VAPT deliverable doubles as evidence for whichever regulator is breathing down your neck this quarter.
Information security audit empanelled by Indian CERT
RBI Cyber Security Framework + System Audit Reports
Cybersecurity & Cyber Resilience Framework for capital markets
ISMS implementation, internal audit and certification support
Payment card industry — ASV scans, internal audit, pentest
Article 32 controls, DPIA, data flow mapping
Healthcare data protection (relevant for India + UAE health-tech)
UAE National Electronic Security Authority compliance
Every report card has eight axes.
CVSS isn’t enough — we attach business-impact, MITRE technique, exploit weaponisation status, fix-effort estimate and re-introduction likelihood to every High/Critical finding.
- CVE/CWE pinning
- MITRE ATT&CK technique mapping
- Validated CVSS + business risk score
- Reproduction script + screenshots
- Remediation effort estimate
- Verified-fix retest result
SSRF in image-proxy → AWS instance metadata exposure
The internal image-resize service accepts a user-controlled URL parameter, fetches it server-side, and returns the body. Pointing the URL at the EC2 metadata endpoint (169.254.169.254) returns IAM credentials with s3:*and kms:Decrypt permissions.
curl 'https://target/img-proxy?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/web-role'
{"Code":"Success","AccessKeyId":"ASIA...","SecretAccessKey":"...","Token":"..."}- FoundDay 6 · authenticated scan + manual recon
- ValidatedDay 7 · PoC executed in isolated tenant
- ReportedDay 9 · CERT-In format · risk register updated
- Re-testedDay 21 · fix verified · closure letter issued
Tools we trust. And tools we built ourselves.
Nessus, Qualys, Burp Pro, Nuclei, Trivy, Checkov — the same scanners every senior BFSI red team runs first, because they catch the obvious things quickly and free our operators to chase what really matters.
But scanners only see what they were taught to see. When ours hit something a commercial tool would miss — a chained CSP bypass, a quiet SSRF inside a JSON proxy, a serverless privesc path — we don’t shrug. We write the Burp extension, the Nuclei template, the Pacu module that catches it. On your engagement you get both: the tooling everyone else runs, and the bits we built ourselves.
What lands in your inbox
- VAPT report in CERT-In submission format
- Risk register updates with CVSS + business risk score
- Findings tracked by severity, asset, owner, ETA
- Remediation guidance per CWE
- Free retest within 30 days
- Annual closure letter + Macksofy attestation
Sectors we operate in
Empanelled by CERT-In. Accredited by EC-Council.
“We've worked with three Big 4 firms before Macksofy. None found what their team did in our payments stack. The most actionable report we've received in a decade.”
“The CHFI training Macksofy delivered for our cyber cell raised investigation quality measurably. Practical, India-context-aware, and respectful of our operational realities.”
“Came in with zero security background. 5 weeks later I was running Burp Suite and Metasploit confidently. Cleared CEH on the first attempt.”
Things people ask before signing.
Where Macksofy delivers VAPT.
On-site engagements across India's BFSI, fintech, government and SaaS metros plus the UAE. Senior consultants fly from Mumbai BKC for kickoff, key reviews and exit briefings; remote weeks run through the rest of the engagement.
Macksofy delivers this work to the following standards and regulator requirements. Definitions and controls are sourced from the issuing bodies below.
Get a fixed-price proposal in 48 hours.
Tell us about your security need — pentest, audit, training or a wider engagement. A senior consultant will reply within a few business hours.
- CERT-In Empanelled
- EC-Council ATC · CompTIA Authorized
- Thousands of professionals trained
- India + UAE engagements