NDA before anything is shared
A confidentiality agreement is in place before you send requirements, data or access.
Security & VAPT · secured data
Our VAPT team finds the weaknesses in your web apps, APIs, mobile apps, cloud and AI before someone else does. Every project we deliver follows the same data-security practices.
- ✓ Access control: other users’ records
- ✓ Injection: SQL, NoSQL, command
- ▶ Authentication & session handling
How we protect your data
Your data is safe with us, by default.
These practices apply to every project, whether we are building software, running AI or testing your security.
Least-privilege, named access
Each person gets their own account with only the access the task needs, protected by multi-factor sign-in, and removed at handover.
Encrypted in transit and at rest
Systems we build and run use HTTPS everywhere and encrypted storage and backups.
Your data stays in your systems
We work inside your environments where possible, use sample data for development and never keep copies on personal devices.
Secrets never in code
Passwords, keys and tokens live in secret stores, are rotated, and are blocked from repositories by automated checks.
Secure development lifecycle
Code review, dependency and vulnerability scanning, and security tests run before every release.
AI without data leakage
Your data is never used to train public AI models; AI features respect the same permissions as the source data.
Fast incident response
If something goes wrong, you are told quickly, with what happened, what was affected and how it is being fixed.
VAPT services
Everything an attacker could reach, tested.
Pick one target or combine them. Each test is scoped to what you own or are authorised to test.
Web application VAPT
Authentication, access control, injection, business-logic and session testing against the OWASP Top 10.
API security testing
REST and GraphQL APIs tested against the OWASP API Security Top 10, including object-level authorisation.
Mobile app VAPT
Android and iOS apps tested against OWASP MASVS: storage, network, reverse engineering and backend APIs.
Cloud configuration review
AWS, Azure and Google Cloud identities, storage, network exposure and logging, checked against CIS benchmarks.
Network & infrastructure
External and internal network testing: exposed services, patching, segmentation and weak configurations.
AI & LLM security
Prompt injection, jailbreaks, data leakage, insecure tool use and retrieval access control, aligned to the OWASP Top 10 for LLM applications.
Secure code review
Manual and automated review of your source code for vulnerabilities that black-box testing can miss.
Business-platform security
Roles, sharing rules, API access and integrations in Zoho, Salesforce, NetSuite, Microsoft and Odoo.
OWASP Top 10OWASP API Security Top 10OWASP MASVSOWASP Top 10 for LLMCVSS severityCWECIS BenchmarksNIST SP 800-115PTES
How a VAPT works
From scoping to a clean retest.
- 1Scope & authoriseTargets, test window and rules of engagement agreed in writing.
- 2Threat modelMap how the system works and where an attacker would aim.
- 3TestAutomated scanning plus in-depth manual testing by specialists.
- 4Verify safelyProve impact with minimal, non-destructive steps.
- 5ReportExecutive summary and technical findings with CVSS severity and evidence.
- 6Fix & retestFix guidance, a call with your developers and a retest of every fix.
What you receive
A report your developers can act on, and your auditors can trust.
Findings are ranked by real risk to your business, not by how many we could list.
Deliverables
- Executive summary in plain language for management and auditors
- Every finding with CVSS severity, evidence, steps to reproduce and business impact
- Clear fix guidance for your developers, with code-level examples where useful
- Immediate notice of any critical finding during testing, not only in the report
- A retest of fixed findings and an updated report
- A closure letter confirming the scope, dates and results of testing
VAPT teams & cost
Security testing with a clear price.
Prices come straight from our live rate card. Open any team in the pricing builder to adjust it.
VAPT
Web, API & mobile VAPT
A vulnerability assessment and penetration test of one web application, its APIs or one mobile app, with a prioritised report, fix guidance and a free retest.
- VAPT / security testerMid-level · 40 h
- Solution architectSenior · 8 h
- Scoping call and written rules of engagement
- Testing aligned to OWASP Top 10, API and Mobile Top 10
- Report with severity, evidence and fix guidance
- Retest of fixed findings and a closure letter
From$2,369/ month · 48 h · 10% monthly discount applied
Model this team VAPT
Continuous security testing
Monthly security testing for teams that release often: new features are tested, regressions are caught and your security posture is tracked over time.
- VAPT / security testerMid-level · 16 h
- Cloud / DevOps specialistMid-level · 8 h
- Monthly testing of new and changed features
- Dependency and configuration checks in your pipeline
- Open-risk register with fix owners and dates
- Quarterly summary for management and auditors
From$1,030/ month · 24 h · 10% monthly discount applied
Model this team AI Security
AI and LLM security review
Security testing for AI features: prompt injection, data leakage, unsafe tool use and access-control gaps in chatbots, agents and retrieval systems.
- VAPT / security testerSenior · 16 h
- AI / LLM developerMid-level · 8 h
- Threat model of the AI feature and its data
- Prompt-injection and jailbreak testing
- Data-leakage and access-control checks
- Guardrail and monitoring recommendations
From$1,375/ month · 24 h · 10% monthly discount applied
Model this team VAPT / security testerAssociate $32 · Mid-level $48 · Senior $68 per hour
Solution architectMid-level $64 · Senior $89 per hour
Cloud / DevOps specialistAssociate $30 · Mid-level $47 · Senior $66 per hour
Prices are in US dollars. Large estates, network and red-team engagements are quoted after a scoping call.
We test ourselves too
Think you can find a vulnerability in our products?
Our public Security Challenge rewards researchers who find and responsibly report real vulnerabilities in Vlightsoft products.
Codathon 2026
Security Challenge
Cash rewards for the top researchers and a hall-of-fame credit for every valid finding, under clear safe-testing rules.
Questions
Security & VAPT: FAQ
What is VAPT?
Vulnerability Assessment and Penetration Testing. The assessment finds weaknesses with automated and manual checks; the penetration test safely proves which ones an attacker could actually exploit and what they could reach.
Is it safe to test our live system?
Yes, within agreed rules. We avoid destructive tests, agree test windows, and can test a staging copy instead. You can stop testing at any time.
Do you need our source code?
No. We can test from the outside (black box), with test accounts (grey box) or with code access (white box). Grey and white box find more in the same time.
How long does a VAPT take?
A typical web application or mobile app takes one to two weeks of testing, plus reporting and a retest after you fix the findings.
Will we get a certificate?
You receive a closure letter confirming what was tested, when, and that the reported findings were retested. It supports audits and customer due diligence; it is not a compliance certification by itself.
Do you test your own products too?
Yes. Our products go through the same testing, and our public Security Challenge invites researchers to find vulnerabilities in them for rewards.
Clarity in every system.
Find your weak spots before an attacker does.
Tell us what you want tested. We’ll reply with the scope, the timeline and a fixed price.