What does Small Businesses need from cyber security?
Key takeaways
- The engagement is scoped around the smallest viable security, not a generic checklist.
- A written scope, a fixed price band and a delivery date before work starts.
- A technical report for your engineers and a one-page summary for decision makers.
- A retest after remediation is included as standard on assessment work.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What actually matters for small businesses?
There is a lot of published advice that assumes an organisation unlike yours, which is why it often does not survive contact with your actual week. Here is what we consider the genuine exposure in your situation, and how each item is handled.
- A website and email that attackers cannot use to move money
- Ransomware readiness and a tested backup
- A security sign-off for larger customers
- Training a small team without a security function
- A fixed price and a date you can plan around
Which services fit this situation?
What gets tested is decided by what is actually exposed, and that is not identical across this category. This is how an engagement here usually gets scoped.
| Service | When it is the right answer | Indicative range (ex-GST) |
|---|---|---|
| VAPT and penetration testing | You want to know what an attacker would actually find | Rs 45,000 - 6,00,000 |
| Cyber security audit and gap assessment | You need the map before you commission the test | Rs 60,000 - 2,50,000 |
| Managed security operations | You need someone watching between engagements | Rs 2,50,000 - 12,00,000 per year |
| Incident response retainer | You need a 4-hour response when something happens | Rs 2,50,000 - 6,00,000 per year |
| DPDP and CERT-In readiness | Regulatory deadlines are the driver | Rs 1,00,000 - 5,00,000 |
| Awareness training and phishing simulation | Your people are the most likely route in | Rs 25,000 - 1,50,000 |
How do you approach it?
Start with a short scoping conversation. We ask what you are protecting, what has already happened if anything, and what a serious failure would cost you: in money, in reputation, or in operational downtime. From that we build a scope you can afford, which may well be smaller than the one you asked for. A good engagement is one you will actually complete.
Work is then delivered under a signed rules-of-engagement document. You get a finding log during the engagement rather than only at the end, so your team can start fixing things before the report lands.
Which services fit this situation?
VAPT & Penetration Testing
Authorised vulnerability assessment and penetration testing for web, mobile, API and network.
Web Application Security
Web app testing that reads like a breach report, not a scanner dump.
Mobile App Security Testing
iOS and Android testing of the app binary, the API behind it, and the data it stores.
API Security Testing
Where most modern breaches actually happen, and where most scanners never look.
Network Penetration Testing
Internal network, external perimeter, firewall and segmentation testing.
Cloud Security Assessment
AWS, Azure and GCP configuration review, plus container and Kubernetes testing.
Incident Response & Retainer
24/7 help when something is already happening — and a retainer to stop it happening.
Ransomware Recovery & File Unlock
When files are encrypted, the priority is containment first and recovery second.
What questions do we get asked by small businesses?
Talk to an analyst about small businesses
A short conversation is enough for us to tell you what the work should be. We would rather do that on a call than in a proposal you have to read twice.
Request a quote See pricingLast reviewed: 24 October 2026. Information on this page is general guidance, not legal advice. Prices are indicative bands for a typical scope and are confirmed in a written quote before any work begins.