Loading
Find the holes before an attacker, a customer, or the Data Protection Board does.
Most Indian SMBs treat security as a one-time antivirus purchase — until a vendor's account takeover drains the current account, a leaked customer database surfaces on Telegram, or a partner's compliance questionnaire stalls a deal. Now there's a regulator with teeth too: the DPDP Rules 2025 were notified on 14 November 2025, with penalties up to ₹250 crore per breach, and CERT-In already mandates reporting cyber incidents within 6 hours. We run security the way an operator would: VAPT to find the actual exploitable holes (not a 200-page scanner dump), secure code review on the apps that touch money and customer data, hardened access control and backups so one phished password or one ransomware hit can't end the business, a tested incident-response plan, and a clear, evidence-backed path to DPDP, CERT-In, RBI and PCI DSS compliance. You get a prioritised fix list in plain English, the fixes verified, and the paperwork that lets you pass a buyer's or auditor's security review without scrambling.
We start by mapping what's actually worth stealing in your business — the current account, the customer database, the supplier payment flow, the patient records — and who would want it (a competitor, a ransomware crew, a disgruntled ex-employee). Testing and budget then focus on the assets that would actually hurt you, instead of spreading thin across everything equally.
Automated tools find the easy 20%. The breaches that hurt come from business-logic flaws — changing an order ID to see another customer's invoice, bypassing OTP on a refund, escalating a staff login to admin. We test those by hand, prove they're real, and skip the scanner's false-positive padding that makes reports look thick but useless.
Every finding gets a severity tied to business impact (not just a CVSS number), a plain-English explanation of what an attacker could do, and a specific fix your developer can action. Critical and high issues go to the top; we don't bury a payment-bypass on page 140 next to a missing cookie flag.
A report nobody acts on is wasted money, and a fix nobody verifies is false comfort. We support your team through remediation, then re-test every critical and high finding to confirm it's genuinely closed — and issue a clean closure report you can hand to a customer or auditor.
We don't sell you a binder of policies that don't match how you operate. We map DPDP, CERT-In, RBI or PCI DSS requirements to your real systems, fix the gaps, and produce evidence — logs, configs, consent flows, the breach runbook — that survives an actual audit or buyer due-diligence, not just a checklist tick.
Manual, exploit-driven testing of your websites, web/mobile apps, APIs, cloud and network — proving which holes are real and ranking them by what an attacker could actually do to your business.
We read the code behind your billing software, POS, app or portal — focusing on authentication, payments, the customer database and access checks — to catch flaws a black-box test can miss before they ship.
Data mapping, consent flows, retention and deletion policies, notice language, and the grievance and breach-notification process you now need under the DPDP Rules 2025, scoped to what an SMB actually has to do.
The 6-hour incident-reporting runbook, 180-day India-resident log retention, NTP sync and the RBI Digital Payment Security Controls expected of anyone in the payments and lending chain.
Least-privilege roles, mandatory 2FA/MFA, removing shared and ex-employee logins, and a clean joiner-mover-leaver process — because most SMB breaches start with one over-privileged or never-revoked account.
Immutable, offsite, tested backups on the 3-2-1 rule — and a documented restore drill — so a ransomware hit or a wiped server is an inconvenience, not the end of the business.
A written IR plan, on-call playbooks, and retainer-based help when something happens — so you contain, report within CERT-In's 6 hours, and notify affected customers correctly instead of panicking.
For anyone touching card data: scoping, tokenization so no raw card data sits on your servers, SAQ guidance and the controls to satisfy PCI DSS v4.0.1 and your acquiring bank or gateway.
Right-sized policies (acceptable use, data handling, access, vendor risk) plus phishing-awareness training for staff — the single highest-ROI control, since a phished accountant beats any firewall.
We deliberately attack the places where rupees move — the refund button, the payout API, the UPI/Razorpay callback, the discount and credit-limit logic. These business-logic flaws (changing an amount mid-request, replaying a payment confirmation, approving your own refund) are where SMBs actually get drained, and generic scanners never find them.
We systematically test whether changing an ID in the URL or API call (invoice 1042 to 1043, patient 88 to 89) lets one user pull another's data. This single class of flaw — Insecure Direct Object Reference — is the most common cause of mass data leaks in fast-built Indian SMB apps, so we hunt it deliberately across every endpoint.
We pull every account, API key, shared password and WhatsApp/Tally/bank login, then map who still has access who shouldn't — the resigned accountant, the old developer, the vendor's intern. Orphaned and shared logins are a top breach vector for SMBs, and closing them costs nothing but discipline.
We run a live 'what if we're breached at 2am Saturday' simulation with your team — who calls whom, who isolates the server, who files the CERT-In report within 6 hours, who talks to customers. Most SMBs only learn their plan has gaps during a real breach; we surface them in a 90-minute drill instead.
Everyone 'has backups'; almost no one has tested restoring. We force an actual restore to a clean environment and time it. We routinely find backups that were silently failing for months, encrypted by the same ransomware, or missing the database — better to find that on a Tuesday than after an attack.
We map every field you collect and ask 'do you legally need this, and for how long?' Most SMBs hoard Aadhaar copies, full card numbers and old customer data they never use — pure liability under DPDP. Deleting what you don't need shrinks both your breach blast-radius and your compliance burden at once.
We send a controlled, realistic phishing email (a fake GST notice, a fake vendor invoice, a fake bank alert) to your team and measure who clicks and who enters credentials. The click data turns 'be careful online' into specific, targeted training for the people and departments that actually need it.
When you sell to enterprises, banks or hospitals, their procurement sends a security questionnaire that can freeze a deal for weeks. We build your answers, policies and audit evidence in advance so you respond in a day — turning security from a deal-blocker into a reason they trust you over a cheaper competitor.
We map your assets, data flows and what's worth protecting, agree the systems in scope (apps, network, cloud, payments), and define the rules of engagement so testing never disrupts live operations.
Asset and data-flow mapping, access-and-identity review, backup and log checks, and a gap assessment against DPDP, CERT-In, RBI or PCI DSS — whichever apply to you.
Hands-on penetration testing and, where relevant, secure code review of the apps touching money and customer data — manually proving and ranking every real, exploitable finding.
A risk-ranked report in plain English with a prioritised, developer-actionable remediation plan — critical and high issues first, each with a clear fix and business-impact note.
We support your team through the fixes, harden access, backups and policies, then re-test every critical and high finding and issue a clean closure report.
Final compliance pack (policies, consent flows, IR runbook, evidence), staff awareness training, and an optional retainer for periodic re-tests, monitoring and incident-response standby.
VAPT on the money-flow and payout logic, secure code review, PCI DSS readiness and RBI Digital Payment Security Controls — so a logic flaw or a regulator finding doesn't cost you your licence or your float.
Locking down patient records and prescription data, role-based access so not every front-desk login sees everything, DPDP-aligned consent and retention, and tested backups against the ransomware that regularly hits Indian healthcare.
Securing the POS, e-commerce store and customer database, tokenizing card data so none sits on your servers, and DPDP-ready handling of the phone numbers and order history you collect for marketing.
Protecting the ERP, supplier-payment and email flows from invoice-fraud and account-takeover, auditing vendor and ex-employee access, and securing the WhatsApp/Tally workflows your operations actually run on.
Safeguarding minors' and parents' data (a sensitive category under DPDP), securing fee-payment and admission portals, and putting consent and access controls around the records you're legally responsible for.
A VAPT report, security policies and DPDP/SOC-readiness evidence that lets you sail through the security questionnaires that big customers, banks and hospitals send before they'll sign.
SMBs who need to know where they stand fast — a first honest read on their real exposure and compliance gaps.
from ₹60,000 one-time
Businesses handling real money or customer data who need to be both secure and audit/buyer-ready.
from ₹1,75,000 one-time + optional retainer
Fintech, healthcare and multi-location businesses needing continuous protection, not a one-time audit.
custom (retainer)
Indicative scopes — every engagement is tailored on a quick discovery call.
The count of serious, exploitable issues found and then verified-fixed on re-test — the number that actually moves your risk, not how many low-severity items a scanner listed.
How fast you'd notice and contain an incident, driven down with logging, alerting and a rehearsed IR plan — and kept inside CERT-In's 6-hour reporting window.
Whether a real restore actually works and how long it takes — proven by drill, so a ransomware hit means hours of downtime, not a closed business.
Share of applicable DPDP, CERT-In, RBI or PCI DSS requirements with evidence in place — your readiness to pass an audit or buyer due-diligence.
Shared, over-privileged and ex-employee logins eliminated and MFA enforced — directly shrinking the most common SMB breach vector.
Percentage of staff who fall for a simulated phishing email, tracked over time as awareness training takes hold — your human attack surface, measured.
Indian SMBs and founders who handle money or customer data and can no longer treat security as optional — fintech and lending apps, hospitals, clinics and pharmacies, retail, D2C and restaurants taking digital payments, factories and trading houses running on ERP and email, schools and coaching institutes holding minors' data, and SaaS vendors selling to enterprises that demand a security review. Ideal if you've had a scare, lost or stalled a deal over a security questionnaire, or realised the DPDP Rules 2025 and CERT-In now apply to you and you have no plan.
We ship websites, apps, ERP and payment flows for the same kind of Indian SMBs — so we read code and find money-flow flaws like builders, not box-checkers running a scanner and printing the output.
No 200-page false-positive dump. You get the real, exploitable issues, ranked by business impact, in plain English, with a specific fix per item — and we re-test to prove each one is closed.
DPDP Rules 2025, CERT-In's 6-hour reporting and 180-day India-resident logs, RBI Digital Payment Security Controls and PCI DSS are our default context — scoped to what an SMB must do, not an enterprise checklist you can't afford.
We turn your security posture into evidence — policies, reports, questionnaire answers — that unblocks enterprise, bank and hospital deals, so the spend pays you back in pipeline, not just peace of mind.
Almost certainly, if you collect any personal data of customers, patients or staff digitally — names, phone numbers, Aadhaar/PAN, health or payment data. The DPDP Rules 2025 were notified on 14 November 2025 with a phased timeline (most obligations land by 13 May 2027), and penalties run up to ₹250 crore per breach. There's no blanket small-business exemption, but the obligations scale with what you collect. On the first call we'll tell you honestly what applies to you and what's genuinely optional, so you don't over- or under-spend.
No. We agree clear rules of engagement before we start — what's in scope, what's off-limits, and timing windows. Most testing runs against a staging copy or during low-traffic hours, and destructive tests are never run without explicit sign-off. The whole point is to find the holes safely, before a real attacker finds them carelessly.
A scan is an automated tool that flags possible issues — it's fast, cheap, and full of false positives and missed business-logic flaws. VAPT means we manually verify and exploit the real issues: actually changing an order ID to see another customer's data, or trying to bypass a payment. You get proof of what's genuinely exploitable, ranked by business impact, instead of a noisy list nobody trusts or acts on.
Those help, but most SMB breaches walk right past them — a phished password, an over-privileged ex-employee login, a flaw in your own app's payment or refund logic, or a ransomware hit on untested backups. Antivirus and a firewall are doors and locks; we check whether the windows are open, who still has old keys, and whether you could rebuild if someone got in. They're a starting point, not a strategy.
If you're on a retainer, you call us and we help you contain it, preserve evidence, report to CERT-In within the mandated 6 hours, and notify affected customers correctly under DPDP — calmly, from a written playbook. Even on a one-time engagement we leave you with an incident-response plan so your team knows exactly who does what. The worst time to figure out your breach process is during a breach.
A focused Security Health Check on one asset starts from ₹60,000 and takes about two weeks; a full Secure & Comply engagement with VAPT, code review, remediation and DPDP compliance typically runs 6–8 weeks. Cost depends on how many systems are in scope and how much data and money they touch. On the first call we'll scope it honestly and tell you what to fix first if budget is tight — securing the money-flow and customer database before the nice-to-haves.
Whether you need to replace spreadsheets, connect SaaS tools, build a custom ERP, launch a SaaS product, generate better leads or automate WhatsApp follow-ups — TheManki can help you build the system your business deserves.