What does an AI-Driven Ethical Hacking engagement cover in India?
Key takeaways
- Scope, price band and delivery date are agreed in writing before any testing starts.
- Every finding ships with a reproduction step and a concrete fix, not a tool name.
- A one-page plain-English summary is included so non-technical decision makers can act.
- A retest after remediation is included and lists each finding as closed, partial or open.
- The report states what was tested and what was not, so you know the limits of the result.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What does the engagement include?
AI-assisted testing for broad coverage, with certified human testers doing the exploitation and signing off. The concrete scope depends on your estate, and we set it out line by line in the rules-of-engagement document before we begin.
- AI-assisted discovery across web, API, mobile and cloud surfaces
- Automated triage that removes noise so humans only read real leads
- Human exploitation and verification of every finding that matters
- Business-logic and workflow abuse testing that automation cannot do
- A signed human report, not raw scanner output
What will you receive?
- A human-written report with reproduction steps, CVSS scores and fixes
- A coverage note stating exactly which estate was machine-scanned and which was hand-tested
- An evidence pack with request and response captures for each finding
- A retest certificate listing each finding as closed, partial or open
How does the engagement run?
We run engagements in a fixed order. A scoping call comes first, and its job is to establish what a useful test would actually cover rather than what sounds impressive. Next comes the rules-of-engagement document, which names every system, every date, the test window, the contact on your side, and what is out of scope. Both parties sign it. The test runs inside the agreed window. The report follows, your team applies the fixes, and we retest to confirm the fixes held.
| Stage | What happens | What you get |
|---|---|---|
| Scoping | A call and, where needed, a short technical discovery | A written scope and a fixed price band |
| Authorisation | Rules of engagement signed by both parties | A document for your legal and insurance files |
| Testing | Manual and AI-assisted testing inside the agreed window | A live finding log you can ask about at any point |
| Reporting | Technical report plus a one-page executive summary | Prioritised findings with reproduction steps and fixes |
| Remediation | Your team fixes, we answer questions during the work | Support while the fixes are in flight |
| Retest | We re-test what we raised | A retest certificate per finding |
What do you get, and when?
Whatever the service, the deliverables follow the same pattern. That is not bureaucracy, it is what lets a client compare two vendors on equal terms instead of comparing two different lists of things they have decided to call a report.
| Deliverable | What it contains | When you get it |
|---|---|---|
| Written scope and rules of engagement | Every system, date, permitted technique and named contact | Before testing starts |
| Live finding log | Findings as they are raised, with severity | During the engagement |
| Technical report | CVSS scores, reproduction steps and fix guidance | At the end of testing |
| Executive summary | One page, written for a non-technical decision maker | With the technical report |
| Evidence pack | Request and response captures for every finding | With the technical report |
| Remediation support | Answers while your team applies the fixes | While the fixes are in flight |
| Retest certificate | Each finding marked closed, partial or open | After remediation |
How do you price it?
₹12,000 to ₹30,000 per tester-day, quoted after scoping is the indicative band for a typical scope of this type. The final figure depends on the number of assets, the depth of authentication, the number of environments, and whether the engagement includes remediation support. We quote a fixed price, not an hourly one, and we confirm it in writing before work starts.
Where do you deliver this service outside India?
The same engagement, delivered remotely from Kochi, into United Arab Emirates, Saudi Arabia, Qatar, Kuwait, Bahrain, Oman, Malaysia, Singapore. Every one of those countries has its own regulator and its own data protection instrument, and the written scope names the framework your entity has to meet before any testing starts.
| Country | Cities covered | Regulator |
|---|---|---|
| United Arab Emirates | <a href="/cyber-security-in-dubai/">Dubai</a>, <a href="/cyber-security-in-sharjah/">Sharjah</a>, <a href="/cyber-security-in-abu-dhabi/">Abu Dhabi</a>, <a href="/cyber-security-in-al-ain/">Al Ain</a>, <a href="/cyber-security-in-ajman/">Ajman</a> | The National Cybersecurity Authority (NCA) sets the national control framework, and the Dubai Cyber Security Index and the Abu Dhabi ISASecure/Desc framework are used by entities operating there. |
| Saudi Arabia | <a href="/cyber-security-in-riyadh/">Riyadh</a>, <a href="/cyber-security-in-jeddah/">Jeddah</a> | The National Cybersecurity Authority (NCA) publishes the Essential Cybersecurity Controls (ECC), and SDAIA runs the personal data side of the framework. |
| Qatar | <a href="/cyber-security-in-doha/">Doha</a> | The National Cyber Security Agency (NCSA) is the national incident response point, with the Ministry of Communications and Information Technology above it. |
| Kuwait | <a href="/cyber-security-in-kuwait-city/">Kuwait City</a> | The Communications and Information Technology Regulatory Authority (CITRA) is the sector regulator for telecoms and internet services, and the national cyber security framework sits with the relevant national authorities. |
| Bahrain | <a href="/cyber-security-in-manama/">Manama</a> | The National Cyber Security Centre (NCSC) is the national incident response body, and the Personal Data Protection Authority is the data protection regulator. |
| Oman | <a href="/cyber-security-in-muscat/">Muscat</a> | The Information Technology Authority (ITA) is the national cyber security regulator and the national incident response point. |
| Malaysia | <a href="/cyber-security-in-kuala-lumpur/">Kuala Lumpur</a>, <a href="/cyber-security-in-petaling-jaya/">Petaling Jaya</a>, <a href="/cyber-security-in-johor-bahru/">Johor Bahru</a>, <a href="/cyber-security-in-george-town/">George Town</a>, <a href="/cyber-security-in-ipoh/">Ipoh</a>, <a href="/cyber-security-in-kota-kinabalu/">Kota Kinabalu</a> | The National Cyber Security Agency (NACSA) and the Cyber Security Commission of Malaysia sit at the centre of the national framework, and the Personal Data Protection Commission runs the data side. |
| Singapore | <a href="/international-singapore/">Singapore</a> | The Cyber Security Agency (CSA) of Singapore sets the national framework and runs the national incident response centre. |
Which locations do you cover?
United Arab Emirates, Saudi Arabia, Qatar, Kuwait, Bahrain, Oman, Malaysia, Singapore. The country pages list the cities in each country and the law that applies to a client there.
What are the common questions about this service?
Request a scoped quote for ai-driven ethical hacking
The reply you get back will be a fixed price and a start date, not a discovery call and a proposal a month later. Send the scope and the deadline.
Request a quote See pricingLast reviewed: 24 October 2026. Information on this page is general guidance, not legal advice. Prices are indicative bands for a typical scope and are confirmed in a written quote before any work begins.