Skip to main content
Buyer's Checklist

What to ask any security partner, and how we answer

Ten questions to put to every VAPT vendor on your shortlist, us included. Our answer is under each one. Ask the others the same, then compare.

Download the VAPT RFP Template and Vendor Evaluation Pack

The pack turns these questions into a scoring matrix, a vendor qualification checklist and a compliance map your procurement team can use as is.

  1. 1. Are you CERT-In empanelled, and since when?

    Indian regulators expect a CERT-In empanelled auditor for regulated audits, and for some, such as RBI's payment aggregator and gateway audits, it is a formal requirement. A recent or lapsed empanelment is worth knowing before you sign.

    Our answer: Yes. Security Brigade has been CERT-In empanelled continuously since 2008, one of the earliest firms in India to hold the designation.

  2. 2. Who will actually test our systems, and how experienced are they?

    Proposals often lead with senior names while juniors do the work.

    Our answer: A team of 150+ security professionals with 5 to 18+ years' experience, and senior practitioners do the testing. The team holds OSCP, OSCE, CEH, CRTP and other certifications. Red team engagements are staffed only with practitioners who have at least six to eight years of hands-on offensive work.

  3. 3. How much of the work is manual, and how much is a scanner?

    Scanner output sold as a penetration test is the most common complaint buyers have about VAPT.

    Our answer: Automation handles discovery, correlation, JavaScript analysis and secret detection, so every allocated day goes on manual testing: business logic, authentication bypass, access control and transaction abuse. Every AI-assisted finding is checked by hand before it reaches you.

  4. 4. How do you make sure nothing in scope was missed?

    Coverage gaps don't show in a report: you only ever see what was tested.

    Our answer: Every engagement starts with a mind map of the whole application or attack surface, every API endpoint, flow and component, before testing begins. Lemon, our audit platform, checks coverage against that map, and every project passes an L1 auditor, an L2 senior consultant and an L3 lead. Nothing is released without manager sign-off.

  5. 5. What does a finding look like in your report?

    Developers fix what they can reproduce.

    Our answer: Each finding comes with a step-by-step proof of concept in Burp Suite and cURL, the exact endpoint, file or line it affects, and remediation guidance a developer can act on. No wildcard instances: every issue is mapped to each place it occurs. See our sample reports.

  6. 6. Can we see findings while the test is running?

    Waiting three weeks for a PDF wastes three weeks of fixing.

    Our answer: Yes. Lemon gives you a live dashboard: findings as they are identified, the timeline, issue status and blockers, so your developers can start fixing during the engagement.

  7. 7. What happens after the report?

    If the vendor disappears after delivery, proving the fixes is left to you.

    Our answer: Remediation runs as a tracked workflow in Lemon, not an email chain: each fix is retested and verified, and a finding closes only when it is confirmed fixed.

  8. 8. Will your report stand up to our regulator or auditor?

    A report the auditor rejects means paying for the test twice.

    Our answer: We audit to CERT-In, RBI, SEBI CSCRF and PCI DSS requirements and map each finding to the framework your auditor reads. For PCI DSS we prepare you for your QSA's audit; we are not a QSA ourselves.

  9. 9. How long have you been doing this, and who trusts you?

    Track record is the one thing a new vendor cannot fake.

    Our answer: Since 2006: more than 6,700 security assessments for over 1,000 organisations in banking, fintech, SaaS, manufacturing, healthcare and government. Sixty to seventy per cent of our new business comes from client referrals.

  10. 10. What exactly is in the price?

    Two quotes for "10 days" can buy very different amounts of testing.

    Our answer: Our proposal states the effort in days and exactly what is in scope. Reporting is automated through Lemon, so the days you pay for go on testing, not on writing up.

Ready to compare?

Download the VAPT RFP Template and Vendor Evaluation Pack, or talk to us about your scope.

Get the RFP pack Talk to us about your scope