CERT-In Empanelled Security Auditor
Penetration Testing That Doesn’t End With a PDF.
Continuous, expert-led penetration testing across Web, API, Mobile, Network, Cloud and Active Directory — with remediation guidance, revalidation and continuous visibility into your security posture.
Why it matters
72%
Data leakage or loss
Industry figures on the most common causes of security incidents. A single unaddressed vulnerability in a network-attached device is enough for a material loss.
- Unauthorised access to company data and systems
- 56%Unauthorised access to company data and systems
- Users downloading unsafe apps or content
- 54%Users downloading unsafe apps or content
- Malware
- 52%Malware
Services
Every engagement produces a technical report and an executive summary — the two audiences need different documents, not the same one twice.
GRC
Twenty services, one consistent way of thinking about assurance: understand the requirement, understand the risk, implement the control, and prove that it works.
Standards (ISO/IEC 27001, 27701, 42001), privacy and data protection (GDPR, DPDPA, PIA/DPIA), security frameworks (NIST CSF, NIST SP 800-53, SOC 2, PCI DSS, HIPAA), assurance and risk services, business resilience, and security leadership.
What this involvesVAPT
A comprehensive testing approach that identifies vulnerabilities and actively exploits them to assess real security posture.
Testing covers web and mobile applications, APIs, networks, thick clients, Active Directory, cloud platforms and OT environments. Findings arrive with proof, business impact and a remediation path, not just a scanner list.
What this involvesConfiguration Review
Identifying optimal configurations against CIS benchmarks, because most breaches trace back to misconfiguration rather than an unknown flaw.
Reviews cover firewalls, endpoints, switches, Microsoft 365, Google Workspace, MDM, DLP, backup, Active Directory, PAM, IAM, CASB, SASE and SAP.
What this involvesRed Teaming
Simulating real-world attack scenarios to test whether security measures hold under an adversary who is trying, not a checklist.
Engagements run against cloud, infrastructure and people, and increasingly against AI systems — LLM applications, agent tooling and the trust boundaries between them.
What this involvesPhishing Simulation & Awareness
The human layer is the largest attack surface. We measure it, then improve it.
Campaigns run as a baseline, followed by targeted training and a repeat campaign, so the result is a trend rather than a single score.
What this involvesIncident Response & Ransomware Recovery
When an incident is live, the priority is containment and getting the business back — analysis comes after.
Containment, eradication, recovery and forensic analysis, following the NIST SP 800-61 lifecycle. Ransomware work includes backup validation, decryption feasibility and clean rebuild guidance.
What this involvesVulnerability Fixation
Finding vulnerabilities is the easy part. Most assessments produce a backlog rather than a fix.
Validation, prioritisation and remediation carried out with your teams or directly, then verified by retest so closure is evidenced rather than assumed.
What this involvesFrameworks
Mapped to the standards you already use
Testing is aligned to OWASP, PTES, NIST SP 800-115 and CIS benchmarks. Red team work is mapped to MITRE ATT&CK, and to MITRE ATLAS for AI systems.
- OWASP
- CIS Benchmarks
- PTES
- NIST SP 800-115
- CERT-In
- MITRE ATT&CK
- MITRE ATLAS
- NIST SP 800-61
- ISO/IEC 27001
Our approach
The same sequence whether it is one application or a full network. Nothing starts until scope is agreed in writing.
- STEP 01
Scope & Risk Analysis
Agree what is in scope, what it is worth, and what would hurt.
- STEP 02
Security Architecture Analysis
Understand how the environment is built before trying to break it.
- STEP 03
Threat Modeling
Work out who would attack this, and how they would go about it.
- STEP 04
Test Plan & Preparation
A written plan, agreed in advance. No surprises during execution.
- STEP 05
Test Execution
Controlled testing against the agreed scope, evidenced as it goes.
- STEP 06
Document & Report Findings
Proof, business impact and severity — not a scanner dump.
- STEP 07
Recommend Remediation
What to fix, in what order, and how to confirm it is fixed.
Near zero
Reduced security defects
5×
Faster threat detection
Trusted by
Who we work with
Most engagements are confidential. Sector and scale is what we can say about the rest.
$1B
Insurance & Fintech
$200B
Private Equity
$739M
Automobile
$200M
Health & Pharma
$25M
SaaS & e-Commerce
In their words
Reproduced as published, from CyberSmithSECURE’s capability statement and from recommendations left on the record.
Dealing with a live incident?
Call us. No form, no queue, no ticket — the number reaches a person.