Question 1

What is VAPT and why do companies need it?

Accepted Answer

VAPT (Vulnerability Assessment & Penetration Testing) finds security weaknesses before attackers do. It combines automated scanning with manual exploitation across web apps, networks, APIs, mobile apps, and cloud environments, and is often required for RBI, PCI DSS, and enterprise due diligence.

Question 2

What types of penetration testing do you offer?

Accepted Answer

We cover web application testing, network testing, mobile application testing, API testing, and cloud testing — with OWASP-aligned methodology, CVSS scoring, and a free retest after remediation.

Question 3

How often should we conduct VAPT?

Accepted Answer

At least annually for most organizations, and after major releases or infrastructure changes. Financial institutions typically follow RBI guidance for periodic VAPT on critical systems.

Question 4

What's included in a VAPT engagement?

Accepted Answer

Scoped testing, automated discovery, manual verification, executive and technical reports with CVSS scores, prioritized remediation guidance, and a free retest to confirm fixes.

Question 5

How long does a VAPT take?

Accepted Answer

A focused web or API engagement often takes 2–4 weeks. Broader network, mobile, or multi-cloud scopes can take 4–8 weeks depending on asset count and access windows.

Question 6

What is included in digital forensics?

Accepted Answer

Forensic imaging, evidence preservation, timeline analysis, malware and data-breach investigation, and court-ready reporting that maintains chain of custody.

Question 7

What are red teaming assessments?

Accepted Answer

Red teaming simulates real-world adversaries against your people, processes, and technology to test detection and response — beyond a standard vulnerability scan or checklist pen test.

Question 8

When should we engage forensics vs red teaming?

Accepted Answer

Use forensics after a suspected incident or for legal evidence. Use red teaming proactively to validate defenses, SOC readiness, and incident-response playbooks.

Question 9

Do you provide litigation support?

Accepted Answer

Yes. We produce court-ready reports and can support counsel with technical briefings, evidence packages, and expert explanation of findings.

Question 10

What does GDPR compliance support include?

Accepted Answer

Gap assessment, data mapping, privacy notices, DPIA support, technical and organizational measures, and ongoing compliance monitoring for EU personal data processing.

Question 11

Who needs GDPR services?

Accepted Answer

Any organization offering goods or services to EU residents, or monitoring EU individuals — including Indian exporters, SaaS vendors, and BPOs handling EU data.

Question 12

How long does a GDPR readiness engagement take?

Accepted Answer

Typical readiness programs run 4–12 weeks depending on data complexity, number of systems, and whether you need implementation support beyond assessment.

Question 13

Do you help with breach notification requirements?

Accepted Answer

Yes. We help define incident response procedures aligned to GDPR's 72-hour supervisory authority notification expectations and documentation duties.

Question 14

What is OWASP-aligned testing?

Accepted Answer

Security testing mapped to the OWASP Top 10, ASVS, Testing Guide, and API Security Top 10 — combining automated checks with manual verification of business logic flaws.

Question 15

Is OWASP testing only for web apps?

Accepted Answer

No. We cover web applications and APIs (REST, GraphQL, SOAP), including authentication, authorization, and business-logic abuse cases.

Question 16

Do you provide developer-ready findings?

Accepted Answer

Yes. Reports include reproduction steps, evidence, severity scoring, and concrete remediation guidance for engineering teams.

Question 17

How does OWASP testing relate to VAPT?

Accepted Answer

OWASP testing is a focused methodology within our broader VAPT offering — ideal when web/API risk is the primary concern.

Question 18

What is a NIST CSF assessment?

Accepted Answer

A maturity review across Identify, Protect, Detect, Respond, and Recover — with gap analysis, control mapping, and a prioritized improvement roadmap.

Question 19

Do you map to NIST SP 800-53?

Accepted Answer

Yes. We can map your controls to NIST SP 800-53 families when you need deeper federal-style control coverage or vendor assurance.

Question 20

Who typically needs NIST CSF work?

Accepted Answer

Enterprises building a security program baseline, suppliers facing NIST-aligned questionnaires, and teams preparing for broader compliance initiatives.

Question 21

What deliverables do we receive?

Accepted Answer

Current-state scorecard, gap register, target profile, roadmap with owners/timelines, and executive briefing materials.

Question 22

What ISO 27001 services do you provide?

Accepted Answer

Gap assessment against ISO 27001:2022, ISMS design, Annex A control implementation support, Statement of Applicability, internal audit, and Stage 1/2 certification support.

Question 23

How long does ISO 27001 certification take?

Accepted Answer

Many organizations reach Stage 1 in 3–6 months if leadership is engaged; full certification timelines vary with scope and control maturity.

Question 24

Do you replace the certification body?

Accepted Answer

No. We prepare you for an accredited certification body audit and support you through findings closure — we do not issue the certificate ourselves.

Question 25

Is ISO 27001 useful without certification?

Accepted Answer

Yes. Many teams adopt the ISMS for stronger governance even before pursuing formal certification.

Question 26

What is the DPDP Act 2023?

Accepted Answer

India's Digital Personal Data Protection Act governs how personal data of individuals in India is processed — covering Data Fiduciaries, consent, rights, and obligations.

Question 27

What DPDPA services do you offer?

Accepted Answer

Gap analysis, consent management design, data principal rights procedures, privacy notice drafting, and ongoing compliance support for Data Fiduciaries.

Question 28

How does DPDP differ from GDPR?

Accepted Answer

Both protect personal data, but DPDPA is India-specific with its own consent, rights, and fiduciary concepts. Organizations operating in both regions often need dual-aligned programs.

Question 29

Do startups need DPDP compliance?

Accepted Answer

If you process personal data of individuals in India, yes — obligations scale with your role as Data Fiduciary and the sensitivity of processing.

Question 30

What HIPAA services do you provide?

Accepted Answer

Risk analysis, Business Associate Agreement guidance, administrative/technical/physical safeguards review, and remediation planning for PHI protection.

Question 31

Do IT vendors need HIPAA compliance?

Accepted Answer

Yes, if you create, receive, maintain, or transmit PHI for a covered entity — you typically need Business Associate controls and evidence of safeguards.

Question 32

How is HIPAA different from GDPR?

Accepted Answer

HIPAA focuses on US healthcare PHI and covered entities/business associates. GDPR is broader personal-data regulation for EU residents. Many healthcare tech firms need both.

Question 33

Can you help with HIPAA technical safeguards?

Accepted Answer

Yes — access control, audit logging, integrity controls, transmission security, and encryption guidance mapped to your environment.

Question 34

What is SOC 2?

Accepted Answer

SOC 2 is an attestation report on controls relevant to Security, Availability, Processing Integrity, Confidentiality, and/or Privacy — commonly required by SaaS buyers.

Question 35

What's the difference between Type I and Type II?

Accepted Answer

Type I assesses control design at a point in time. Type II assesses operating effectiveness over a period (typically 3–12 months) and is preferred by most enterprise customers.

Question 36

How long does SOC 2 readiness take?

Accepted Answer

Many organizations need 3–9 months depending on control maturity, tooling, and whether a Type I or Type II report is the goal.

Question 37

Do you work with the external auditor?

Accepted Answer

Yes. We help prepare evidence, close gaps, and coordinate with your CPA firm so fieldwork goes smoothly.

Question 38

What is an IT audit?

Accepted Answer

An independent review of IT controls, processes, and evidence against frameworks such as ISO 27001, CIS, NIST, SOC 2, and sector regulations — with actionable findings.

Question 39

How is IT audit different from penetration testing?

Accepted Answer

Pen testing validates technical exploitability. IT audit evaluates governance, control design/effectiveness, documentation, and compliance evidence across the organization.

Question 40

Which standards can you audit against?

Accepted Answer

ISO 27001, NIST CSF / SP 800-53, CIS Controls, SOC 2 trust criteria, PCI DSS control areas, and India-specific regulatory expectations where applicable.

Question 41

Do you support remediation after the audit?

Accepted Answer

Yes. We prioritize findings, help design corrective actions, and can re-validate controls before your external auditor or regulator review.

Question 42

What does enterprise cybersecurity consulting cover?

Accepted Answer

Risk assessment, security architecture, threat monitoring design, incident response planning, and security audits tailored to your business and regulatory context.

Question 43

How do you start an engagement?

Accepted Answer

We begin with a discovery workshop to understand assets, threats, and compliance drivers, then deliver a prioritized roadmap with clear owners and timelines.

Question 44

Do you support ongoing advisory retainers?

Accepted Answer

Yes. Many clients use Cybrotech as a fractional security partner for architecture reviews, vendor assessments, and continuous improvement.

Question 45

Can this include board-level reporting?

Accepted Answer

Yes. We translate technical risk into executive dashboards and board-ready summaries with business impact and investment options.

Question 46

What is data privacy protection testing?

Accepted Answer

We assess how sensitive data is collected, stored, processed, and shared — including mobile apps, APIs, and cloud workloads — to find leakage and privacy control gaps.

Question 47

Which systems do you typically review?

Accepted Answer

Web and mobile apps, backend APIs, databases, third-party integrations, and employee tooling that may expose PII or confidential business data.

Question 48

How does this relate to DLP products?

Accepted Answer

Privacy testing finds design and process gaps; DLP products enforce controls at endpoints and channels. Many clients use both together.

Question 49

Do you help write privacy policies?

Accepted Answer

Yes. We support privacy notices, retention schedules, and operational procedures aligned to your regulatory obligations.

Question 50

What training programs do you offer?

Accepted Answer

Cybersecurity awareness for employees, phishing simulations, and compliance-focused sessions covering GDPR, HIPAA, ISO 27001, and secure development practices.

Question 51

Can training be customized for our industry?

Accepted Answer

Yes. We tailor examples and threat scenarios for banking, healthcare, SaaS, manufacturing, and other sectors.

Question 52

Do you offer virtual and on-site delivery?

Accepted Answer

Both. We deliver instructor-led virtual workshops and on-site programs across India and the UAE.

Question 53

How do you measure training effectiveness?

Accepted Answer

Pre/post assessments, phishing simulation metrics, attendance tracking, and manager reporting dashboards.

Question 54

Which frameworks do you support?

Accepted Answer

RBI Cyber Security Framework, SEBI Cybersecurity & Cyber Resilience Framework (CSCRF), and IRDAI Information & Cyber Security Guidelines — including gap assessments and remediation.

Question 55

What deliverables are typical?

Accepted Answer

Gap reports, control matrices, CCMP/policy drafts, SOC readiness inputs, incident reporting procedures, and board/management reporting templates.

Question 56

Do you help with CERT-In incident coordination?

Accepted Answer

Yes. We help define detection, escalation, and reporting workflows aligned to regulatory timelines and CERT-In expectations.

Question 57

Is this only for banks?

Accepted Answer

No. It also covers NBFCs, payment aggregators, market intermediaries, MIIs, insurers, TPAs, and other regulated financial entities.

Question 58

What is Sachet SOC?

Accepted Answer

Sachet SOC is Cybrotech's SIEM and XDR platform for threat prevention, detection, and response. It combines log analysis, intrusion and malware detection, file integrity monitoring, vulnerability detection, configuration assessment, and regulatory compliance dashboards in one place.

Question 59

How does Sachet SOC collect security data?

Accepted Answer

Lightweight agents on endpoints forward telemetry to a central analysis server. Alerts are indexed for search and shown on the dashboard. Agentless devices such as firewalls, switches, routers, and network IDS can send logs via Syslog or be probed over SSH/API.

Question 60

Which platforms and workloads can it monitor?

Accepted Answer

Agents run on major operating systems including Windows, Linux, and macOS (and other enterprise OS families). Sachet SOC also monitors cloud instances (AWS, Azure, GCP) at the system level and via cloud provider APIs, plus Docker and Kubernetes environments for container runtime security.

Question 61

What threat detection capabilities are included?

Accepted Answer

Log data analysis with decoders and rules, IOC matching, intrusion and malware detection, file integrity monitoring, vulnerability detection, configuration assessment, and correlation aligned to frameworks such as MITRE ATT&CK.

Question 62

Does Sachet SOC support automated response?

Accepted Answer

Yes. Active response can automatically block IPs, terminate malicious processes, quarantine hosts, and run custom playbooks — reducing mean time to contain while analysts investigate.

Question 63

Which compliance frameworks does it help with?

Accepted Answer

Out-of-the-box compliance views support PCI DSS, GDPR, HIPAA, CIS benchmarks, NIST 800-53, and ISO 27001 evidence gathering — helping teams demonstrate control effectiveness to auditors.

Question 64

Can Sachet SOC scale across large estates?

Accepted Answer

Yes. A single analysis cluster can process data from hundreds or thousands of agents and scale horizontally. Agents can be configured and upgraded remotely from the central console.

Curious about
Cybrotech?

VAPT / Pen Testing

Ask a human — not another FAQ

Curious aboutCybrotech?

VAPT / Pen Testing

01What is VAPT and why do companies need it?

02What types of penetration testing do you offer?

03How often should we conduct VAPT?

04What's included in a VAPT engagement?

05How long does a VAPT take?

Ask a human — not another FAQ

Curious about
Cybrotech?