Sector package
Security and fraud risk for fintechs, NBFCs and payment businesses
Regulated, targeted and fast-moving. The RBI expects a cyber-security framework; attackers expect an API with a missing rate limit.
Request a scopeWhat goes wrong in fintech & nbfcs
- Mule accounts and onboarding fraud
Synthetic or rented identities pass KYC and become the receiving accounts for digital-arrest and investment scams.
- API and mobile-app weaknesses
Broken object-level authorisation, weak OTP flows and client-side trust exposed at scale.
- Regulatory findings
RBI inspections now routinely test cyber-security controls and incident reporting.
Rules that apply to you
- RBI Master Direction on IT Governance (2023) and cyber-security framework for NBFCs.
- RBI incident reporting within six hours; CERT-In directions.
- DPDP Act 2023 for customer data; PCI DSS where cards are handled.
The package
Vulnerability assessment and penetration testing (VAPT)
Manual testing of your web apps, mobile apps, APIs, networks and cloud by people who think like the attacker, with findings ranked by what would actually be exploited first and a report your engineers can act on.
What is included →Fraud risk for fintech, e-commerce and marketplaces
Mule accounts, synthetic onboarding, account takeover, refund abuse and chargebacks cost more than most breaches. We assess where your flows are being abused and design controls that stop fraud without stopping customers.
What is included →RBI, SEBI and IRDAI cyber security frameworks
For NBFCs, fintechs, brokers, insurers and their partners. We map your controls to the regulator's framework, close the gaps that inspections find, and produce the returns and evidence they expect.
What is included →Incident response and digital forensics
Ransomware, a compromised mailbox, a data leak or an insider walking out with the database. We contain first, investigate properly, handle the CERT-In and DPDP reporting, and leave you with evidence that holds up.
What is included →