Straight answers, no sales theatre.

Send an enquiry or call, and we will book a 30-minute scoping call — usually within a day or two. On that call we establish what you actually need, which is not always what was asked for. You then receive a written scope and a fixed price, and nothing begins until you have signed it. There is no obligation attached to the scoping call and we do not charge for it.

We are based in Coimbatore, Tamil Nadu, and we work with clients across India and internationally. Security testing is largely remote work, so location rarely constrains delivery. On-site presence for workshops, internal network testing and training is straightforward across Tamil Nadu and available elsewhere in India by arrangement.

We are a small, senior team, and that is deliberate. The people who scope your engagement are the people who deliver it — there is no model here where a senior consultant sells the work and a junior performs it. The founding team brings over 20 years of combined experience across cybersecurity, cloud, compliance, healthcare and enterprise technology. If our capacity is genuinely the wrong fit for the size of your programme, we will say so rather than take the work.

It depends on scope, and we quote fixed prices rather than day rates that expand. A single web application penetration test is typically the smallest engagement we run; a multi-application programme with internal network and cloud testing is several times that. We publish no price list because any number we printed would be wrong for most readers — but we will give you a firm figure in writing after one call, and we will tell you if a smaller piece of work would answer your question just as well.

Yes, as a matter of course, and usually before the scoping call if you would prefer. Client identities, findings and reports are confidential by default. We do not name clients publicly or use their logos without explicit written permission, which is why this site does not display any — security testing engagements are covered by NDA and we would rather have a thin case-study page than break one.

Yes. We routinely work under enterprise client requirements covering background checks, secure handling of data, restricted-environment working, and non-removal of code or findings. Tell us the constraints during scoping and we will confirm in writing what we can meet.

SemperWise One™ is our cloud-native SaaS platform, architected on AWS, that unifies security, compliance, risk and AI governance in a single dashboard across 28 modules in four groups — Protect, Comply, Govern and Intelligence. It is one product rather than a suite, so there is one data model and nothing to integrate between modules. The platform section of this site marks each module as live or in development, because it is released progressively and we would rather be accurate than impressive.

No. The services practice stands entirely on its own and many clients only ever use it. The platform is what makes continuous work — attack surface monitoring, continuous controls monitoring, managed vulnerability management — practical to deliver, so clients on those services get access as part of the engagement.

Yes. The same codebase deploys to our managed AWS cloud, into a customer-controlled private cloud account where data residency requires it, or on-premises for regulated environments that cannot use shared infrastructure. This is a deliberate design decision rather than an enterprise upsell — a meaningful share of Indian healthcare, financial services and government work simply cannot use multi-tenant SaaS.

Vulnerability intelligence is refreshed daily. That includes exploit-probability scores across 356,454 CVEs, the CISA Known Exploited Vulnerabilities catalogue at 1,662 entries, and a 226,392-row index mapping product versions to the vulnerabilities that affect them. Our own detection library — 10,046 rules across 50 technology packs — is versioned per pack with a review date on each. Current figures and what they mean are published on our detection coverage page.

Yes, for analysis, correlation and drafting — and every finding that reaches a client has been reviewed and confirmed by a person. AI is genuinely good at reading large volumes of output, spotting patterns across findings and producing a first draft of a narrative. It is not reliable enough to be trusted with a severity rating or an exploitability judgement, and we have seen enough confidently wrong AI output in our own tooling to be firm about that. The structured findings are the source of truth; the AI is a productivity layer over them.

Yes. We assess LLM and RAG applications against the OWASP Top 10 for LLM Applications, covering direct and indirect prompt injection, agent and tool permissions, retrieval-layer access control and output handling. This is a distinct assessment from a conventional application test — we have repeatedly found serious AI-layer issues in applications that passed a thorough penetration test weeks earlier, because the test correctly examined the application and had no reason to treat the document corpus as an attack surface.

No. Client data, findings and reports are never used to train models, ours or anybody else’s. Where AI analysis is applied during an engagement, it runs within our controlled environment under the same confidentiality terms as the rest of the work, and clients with strict requirements can have AI analysis disabled entirely for their engagement.