Channel VAPT that reads like the RBI CSITE inspectors want to read it. DDoS defence on payment endpoints that has survived Diwali settlement peaks. PCI-DSS scope work that actually cuts the audit surface. IS Audit evidence packs that hold up when the auditor pushes back. Built for banks, NBFCs, payment aggregators and insurers by a team that has sat across the table from Indian regulators.
Attackers know settlement windows. They know when NPCI, RTGS and card networks are busy. Bot networks flood UPI callback URLs and card auth endpoints at exactly the moment a queue backup will turn into a customer-facing failure. Standard cloud WAF rules do not stop this on their own. You need scrubbing capacity, tuned rate limits, and a runbook the on-call team has rehearsed.
Every leaked password dump from the last five years gets replayed against retail banking logins within days. Static rate limits do not catch a distributed attack running at 4 requests per minute per IP across 40,000 IPs. Device fingerprinting, velocity checks on failed OTPs, and impossible-travel rules on session logins are the baseline now, not a nice-to-have.
Ex-employees still holding VPN certs. Third-party vendors with jump-host access nobody reviewed in 18 months. Shared service accounts sitting in cron jobs. Every RBI CSITE cycle finds these, and every one of them is what shows up in a breach post-mortem.
Account Aggregator, UPI intents, TPAP APIs. Every new integration is a new surface. Consent tokens, request signing, replay windows, and BIN-range rate limits have to be right before the API goes live, not after a breach notification.
Most security vendors run generic playbooks. We ship BFSI-specific ones. Report formats match what RBI CSITE, NPCI compliance and IRDAI inspectors expect. Change control paperwork is written to survive an IS Audit sample review. Every action gets logged in a way your DP officer can hand to the regulator inside 72 hours if a breach notification is triggered.
See full security serviceNamed-tester penetration testing on internet banking, mobile app, public API, and internal network. CVSS 3.1 scoring, PoC screenshots, remediation retest included. Report format matches what CSITE inspectors and NPCI empanelled auditors expect.
Cloudflare Magic Transit, AWS Shield Advanced or Imperva on transaction endpoints. Rate-limit rules per BIN, per device, per merchant. L7 playbook rehearsed with the on-call team. Runbook that stands up on a settlement Saturday.
Gap assessment against the RBI Cyber Security Framework. Control mapping to CSITE questionnaire. Evidence pack for IS Audit sample review. Board-level briefing pack. Sit-in support during the actual inspection window.
Tokenisation architecture, network segmentation of CHD environments, PII flow mapping. Cuts the audit boundary before the QSA walks in. Internal ASV scan management. Annual pen test done in the format PCI DSS 4.0 requires.
Wire your fraud engine outputs into the SOC alert graph. Correlate device fingerprint, login velocity, and transaction patterns. Feed high-confidence alerts into the case management workflow the ops team already uses.
24x7 on-call incident commander. Containment playbook for ransomware, data exfil, insider misuse. CERT-In 6-hour reporting support. Quarterly tabletop exercise with your CISO office. Post-incident review pack for the board and RBI.
15-min call. Tell us the scope, the deadline, and the auditor. We come back with a fixed-price plan and named tester CVs in 48 hours.
If your team already runs Splunk, Qradar or Sentinel, we operate inside it. No rip-and-replace. We agree on the stack in writing during scoping.
Cloudflare Magic Transit · AWS Shield Advanced · Imperva · AWS WAF / F5
Burp Suite Pro · Nessus Pro · Nuclei · MobSF / Frida
Wazuh · Splunk / Qradar · Microsoft Sentinel · Falco (runtime)
CrowdStrike Falcon · SentinelOne · Microsoft Defender
HashiCorp Vault · AWS Secrets Manager · CyberArk (where mandated)
AWS Security Hub · Azure Defender for Cloud · Prisma Cloud / Wiz
Full control mapping, IS Audit evidence, CSITE inspection prep, board briefing.
Scope reduction, tokenisation architecture, ASV coordination, annual pen test.
Consent architecture, purpose limitation, 72-hour breach notification playbook.
Statement of Applicability, risk register, internal audit cycle, cert body handover.
For NBFCs and fintechs selling into US and UK enterprises. Trust criteria mapping.
6-hour incident reporting workflow, log retention for 180 days, SLA integration.
TPAP and PSP guidelines, security audit format, callback URL hardening.
Applicable to insurers and web aggregators, mapped alongside RBI framework.
Web + mobile + API + network surface. Named tester. CVSS scoring. Remediation retest included. Report in the format Indian regulators recognise.
Rs. 1.5-6 LGap assessment, control mapping, policy library, evidence pack, board briefing. Sit-in support during inspection window.
Rs. 4-8 LEdge scrubbing, WAF rules for payment APIs, rate-limit per BIN / device / merchant, L7 runbook, tabletop rehearsal. Vendor licence billed separately.
Rs. 2-4 L24x7 alert triage, phishing takedown, on-call incident commander, quarterly tabletop, CERT-In reporting workflow. Flat monthly.
Rs. 80k-2.5 L/moThis page covers BFSI specifics. For the full service catalogue — access control, backup and recovery, monitoring, continuity planning and how engagements run — see Security & Continuity →
15-min call. Tell us the regulator, the scope, the deadline. We come back with a fixed-price plan and named tester CVs in 48 hours.
