BERRY9 IT Services, home +91 86868 92922

Offensive security and VAPT · Hyderabad · founded 2015

VAPT and offensive security services in Hyderabad and across India

BERRY9 is a VAPT and offensive security firm in Hyderabad, founded in 2015. Our engineers test web apps, mobile apps, APIs, networks and Active Directory by hand, then write a report your developers can fix from.

Request a scoping call Call +91 86868 92922
Small scopes from
INR 9,000 + GST
Typical duration
5 to 10 working days
Testing
Manual, by engineers
Report
Executive + engineering

Last reviewed

attack path / chained findingsIllustrative
Illustrative attack path: attacker → F-01 → F-02 → F-03 → tenant B Findings: F-01, Tenant ID exposed in an API response (Medium); F-02, Endpoint accepts that ID without an ownership check (Medium); F-03, Email change without signing in again (Medium); Chain, Another customer's account taken over (Critical). Also mapped: /mail, /admin, /billing, /export. /mail /admin /billing /export attacker F-01 F-02 F-03 tenant B

Pathattacker → F-01 → F-02 → F-03 → tenant B

Also mapped/mail · /admin · /billing · /export

  1. F-01Tenant ID exposed in an API responseMedium
  2. F-02Endpoint accepts that ID without an ownership checkMedium
  3. F-03Email change without signing in againMedium
  4. ChainAnother customer's account taken overCritical
Illustrative example, not client data: three medium findings that chain into a critical one.

01 / Services

Offensive security services, led by engineers

Our penetration testing is led by people, not tools: scanners help with coverage, and an engineer decides what is real, what matters and how weaknesses combine. We test for startups, SaaS and fintech companies, healthcare, e-commerce and enterprises.

  1. 01Web application testingSigned in as every role, with the focus on flaws scanners miss.OWASP Top 10 · ASVS
  2. 02Mobile application testingThe signed APK or IPA, tested on real devices and the server behind them.Android · iOS
  3. 03API security testingEach endpoint tried as each role, with requests your developers can replay.REST · GraphQL · gRPC
  4. 04Network penetration testingWhat someone on the internet can reach, and how far an insider gets.External · Internal
  5. 05Active Directory testingPrivilege paths charted and the known routes to domain control tried.BloodHound · Kerberoasting

Also tested

Testing for an audit or a customer? See how a penetration test supports SOC 2, ISO 27001, PCI DSS, the DPDP Act and HIPAA work. For a broad first sweep, there is vulnerability assessment and scanning.

All offensive security services, by group

02 / How a test runs

Five phases, the same on every test

The phases are fixed; the depth and tooling adapt to your environment. Plan on one to two working weeks for typical scopes.

  1. Days 1 to 2

    Scope

    A working session with our lead engineer: the assets in scope, the rules of engagement and emergency contacts.

  2. Days 2 to 3

    Reconnaissance

    Passive enumeration first, then active mapping of ports, services and technology.

  3. Days 3 to 5

    Vulnerability identification

    Manual and automated discovery. An engineer removes false positives before they reach your report.

  4. Days 5 to 7

    Exploitation and risk analysis

    Findings are confirmed with a safe proof of concept, and flaws that combine are chained into an attack path.

  5. Days 7 to 10

    Reporting and remediation

    An executive report and an engineering report, with each finding paired with its fix.

The day ranges show the full window; smaller scopes move faster. The whole process is on the methodology page.

03 / Scan or penetration test

What an automated scan leaves out

Every finding in the report has been confirmed by hand.

An automated scan alone

  • Matches known patterns, and nothing else
  • Passes false positives through to the output
  • Lists weaknesses one by one

A BERRY9 engineer

  • Decides what is real and what matters
  • Removes false positives before the report
  • Chains weaknesses into an attack path, with a safe proof of concept

04 / What you get

A report your developers can fix from

Written by hand, not assembled from tool output, for the people who will use it.

  • The executive report explains business risk to founders, managers and auditors.
  • An engineering report with reproduction steps, the exact payloads and a code-level or configuration fix for each finding.
  • CVSS 3.1 severity and a remediation matrix, scored against your architecture and data.

See the structure in our sample VAPT report

BERRY9 · ENGINEERING REPORTIllustrative sample

Example finding · Web application

Missing ownership check on the invoice endpoint

Severity
Medium
CVSS 3.1
6.5
Affected
GET /api/invoices/{id}
Tested as
Customer, tenant A

Steps to reproduce

  1. Sign in as a tenant A customer.
  2. Request an invoice ID that belongs to tenant B.
  3. The API returns tenant B's invoice.
GET /api/invoices/10482 HTTP/1.1 Authorization: Bearer <tenant A token> HTTP/1.1 200 OK (tenant B record)

Fix

Check on the server that the requested invoice belongs to the signed-in user's tenant before returning it, and apply the same check to every object the API serves.

Example layout, not client dataCVSS 3.1 · OWASP A01

05 / Credentials

Certified, and founded in Hyderabad in 2015

BERRY9 IT SERVICES PRIVATE LIMITED was founded in 2015 and is registered in Hyderabad. Security testing is what we do.

Founded in Hyderabad
2015
ISO certificates held by BERRY9
2
Phases in every test
5
Working days for typical scopes
5 to 10

Our two ISO certificates, 27001 and 9001, are shown above and in the page header bar. They are ours; they do not certify your organization. More about BERRY9, and the organizations we have tested for.

06 / Price and turnaround

Starting prices, written down before work starts

Both are starting prices, not flat fees. After a scoping conversation, a written proposal states exactly what is in scope.

Small scopes

Starts fromINR 9,000 + 18% GST

VAPT with BERRY9 starts from INR 9,000 + 18% GST for small scopes such as 3 to 5 external IP addresses or a simple WordPress website, including a vulnerability scan, manual checks, a written report and one free retest.

Ask about a small scope

Every other test

Starts fromINR 27,000 + 18% GST

Beyond that starter scope, every other test starts from INR 27,000 + 18% GST, and the final price depends on the number of roles, endpoints, hosts and environments in scope.

Request a scoping call

The starting price for small scopes includes one free retest. For larger scopes, the retest terms are written into the proposal before work starts.

The cost guide shows what moves the price and how to compare offers, and there are price pages for web application, API and mobile app testing.

07 / Cities

One office in Hyderabad, testing across India

Companies in other cities are served by remote testing from Hyderabad.

We test over the internet, into your network remotely, or on your premises when a test needs it. Our office is at H.No: 8-3-945/A/12 & 13, Sri Venkata Sai Nest Apartments, Nagarjuna Nagar Colony, Yellareddyguda, Hyderabad 500073; call +91 86868 92922 or write to contact@berry9.com.

08 / Inquiry

Tell us your scope and timeline

Share what you want tested and when you need it done, and we will propose a scope and timeline.

Prefer a conversation? Ring +91 86868 92922 or email contact@berry9.com.

Tell us what you need

Tell us what you need and when you need it. We will propose a scope and timeline.

Fields marked * are required.

What do you need?

What is in scope, and anything we should know about it. At least 20 characters.

By sending this you agree that we may use your details to reply to your inquiry, as described in our privacy policy.

We will respond within 24 hours.

09 / FAQ

Frequently asked questions

Short answers about scope, price and how testing works. For anything else, call +91 86868 92922.

What is VAPT?

VAPT stands for vulnerability assessment and penetration testing. The vulnerability assessment finds weaknesses across your applications or network; the penetration test confirms which ones an attacker could actually exploit, and how far they could get. Together they give you a list of real, prioritized risks instead of raw scanner output.

How much does VAPT cost in India?

With BERRY9, VAPT starts from INR 9,000 + 18% GST for small scopes such as 3 to 5 external IP addresses or a simple WordPress website, including a vulnerability scan, manual checks, a written report and one free retest. Beyond that starter scope, every test starts from INR 27,000 + 18% GST. These are starting prices: larger scopes, such as complex web applications, mobile apps with their backend or internal networks with Active Directory, cost more. The price for your scope is set in a written proposal after a scoping conversation.

How long does a penetration test take?

Typical scopes take 5 to 10 working days, counted from kickoff. Large applications with many tenants, complex roles or deep integrations can take longer.

Do you test remotely?

Yes. Web applications, mobile apps, APIs and external networks are tested remotely from our Hyderabad office. Internal network and Active Directory tests need access inside your network, such as a jump host or a VPN account at the level of a regular employee. On-site visits can be arranged when a test needs one.

Do you work with companies in Bangalore and Chennai?

Yes. We serve Bangalore, Chennai, Kochi, Coimbatore, Visakhapatnam, Vijayawada and the rest of India remotely from our only office, in Hyderabad.

What do I receive at the end of the test?

An executive report in plain language, an engineering report with reproduction steps, payloads and a fix for each finding, severity rated against CVSS 3.1 and your environment, and a remediation matrix.

What do you need from us before testing starts?

It depends on the test: application URLs and test accounts for each role for a web application, the signed APK or IPA and a test backend for a mobile app, the API schema and test users for an API, and IP ranges and rules of engagement for a network test. We agree all of this in writing during scoping.

Will testing disrupt our live systems?

Testing is designed to be safe: impact is shown with validated proofs of concept, and we work to avoid disrupting your production environment. What we may demonstrate impact against, and what is a hard stop, is agreed in writing before testing begins.

Latest articles