VITI Security
Contact

Proof of work

No client logos yet. Here is everything else you can check.

Most security firms open with a wall of logos. We are younger than that, so instead of dressing it up: here is the software we built, a scan you can run against your own domain in the next five minutes, the methodology we test to, and the credentials behind it.

Read a full sample VAPT report →Run a free scan on your domain

Verify us

Seven things you can check without talking to us.

No form, no call, no email address required for any of these.

A complete sample report

The full VAPT deliverable, published in the open: executive summary, ranked findings, CVSS and CWE, affected parameters, reproduction steps and remediation. Read it end to end before you spend anything, and judge the work product rather than the sales page.

Vexta, built in-house

Our own vulnerability scanner. Agentless, self-hosted as a single binary, Ed25519-signed so an agent is tamper-evident from install to scan. Published pricing, no demo gate. Read the technical detail on the Vexta page.

A free external scan

Point our free scanner at a domain you own and read the output yourself. It is the same engine we run at the start of an engagement, so you are judging the actual work product, not a brochure.

Our testing methodology, in public

We test to OWASP, NIST SP 800-115 and PTES, and follow CERT-In-aligned methodology for Indian engagements. The four phases and the deliverable at each one are written out on the VAPT page.

What we do not claim

We are not a CERT-In empanelled firm, we are not a certification body, and we have no partnership with one. All three are stated plainly on the pages where they matter rather than buried.

Credentials you can look up

The certifications behind the practice are listed on the founder profile with the issuing body named for each one, and course completions listed separately from certifications.

Free compliance tooling

Two dozen calculators and scorecards for DPDP, SOC 2, ISO 27001, GDPR, HIPAA, PCI and more. Free, and useful whether or not you ever hire us.

Where we actually are

The honest version, because you will find out anyway.

VITI Security has been building since 2020, and the security consultancy practice is the newer half of that. We have a team now, though we do not publish headcount. What we do not have is a shelf of named client case studies, and we would rather say that than manufacture one. Security buyers check, and a firm caught inventing a client reference has told you everything you need to know about how it will handle your data.

  • There are no invented client names, quotes, logos or metrics anywhere on this site. If you ever find one, tell us and it comes down the same day.
  • We do not claim certifications, empanelments or vendor partnerships we do not hold.
  • Client work is covered by NDA by default. When a client agrees in writing to be named, their engagement appears on this page with their name on it.
  • Until that happens, judge us on the software, the methodology, the credentials, and the first deliverable you pay for.
  • Ask us anything on this list directly on a call. We will give you the same answer we gave here.
Ask us the awkward questions →

How to de-risk a first engagement

Start small enough that being wrong about us is cheap.

You should not have to take a leap of faith on a security vendor. The engagement shape below is designed so the first cheque is small and the evidence arrives early.

01

Scan your own perimeter first

Run the free scanner yourself before you speak to anyone here. It costs nothing and it tells you something true about your own external surface. If the output is useless to you, you have learned that at zero cost.

02

A 30-minute scoping call

The real problem in your words. No deck, no discovery gauntlet, no SDR. By the end we both know whether there is a fit worth pricing, and we will say so if there is not.

03

One small fixed-price piece

Deliberately small: a single scoped assessment or one contained fix, with the number agreed before work starts. Not a retainer, not an annual programme, not a platform commitment.

04

You decide if there is a second

No lock-in clause on retainers and no auto-renew you have to remember to cancel. If the first deliverable does not earn the next step, that is the correct outcome and we will not chase you.

What you actually receive

The anatomy of a deliverable.

This is what lands in your inbox at the end of an assessment, whether it is your first engagement or your tenth.

An executive summary

Written for the person who signs off the budget for the fix, not the person who already speaks security. One page, plain English, no CVSS soup.

Findings ranked by exploitability

Ordered by what an attacker could actually do with your setup, not by raw CVE count or vendor severity score.

Proof, not assertions

Each finding carries reproduction steps and evidence so your engineers can confirm it themselves rather than take our word for it.

Remediation that names the fix

Specific guidance tied to your stack, sequenced so the highest-risk items are also the ones your team can ship first.

A walkthrough call

We talk your team through the report rather than emailing a PDF and disappearing. Questions answered live.

A free re-test

Once your team ships the fixes, we re-test at no additional cost. Same engineer, no context loss, no upsell attached.

The questions a careful buyer asks

Can I talk to a reference?
Not yet, and we are not going to pretend otherwise. We have no client who has agreed in writing to be named as a public reference, and putting you on the phone with someone who did not consent would be a breach of exactly the confidentiality we are asking you to trust us with. What we can do instead: walk you through our methodology in detail, hand you a complete sample report to pick apart, let you run the scanner yourself, and structure a first engagement small enough that you are buying evidence rather than a promise.
Why would I hire a firm with no published case studies?
Sometimes you should not, and if a named-reference requirement is non-negotiable for your board or your insurer, an established firm is the right call and we will say so on the call. Where we are the better choice: you want senior hands on the work rather than a partner who sells and a junior who delivers, you want a fixed price you can plan around, and you want to start small. Being early is precisely why the first engagement is scoped the way it is.
What happens if the work is not good?
The first engagement is fixed-price and deliberately small, so the exposure is bounded before you commit to anything ongoing. Retainers carry no lock-in clause, so you can stop at the end of any month. If a finding turns out to be wrong, we say so in writing and correct the report.
Are you CERT-In empanelled?
No. We work to CERT-In-aligned methodology, with the same standards and the same deliverables, but we are not ourselves an empanelled firm. If your regulator or your contract requires an empanelled signature, you retain an empanelled firm for the signoff and we hand off cleanly, with the documentation pack pre-staged so they have less to redo.
Who actually does the work?
A named senior engineer owns your engagement from scoping through remediation, and the founder is on the kickoff call and the quarterly review for every retained client. There is no handoff from the person who sold it to a person you have never met.
How small can an engagement be?
Smaller than you probably expect. A single scoped assessment is a normal starting point, and if a one-hour conversation solves your problem outright we will tell you that instead of writing a proposal.

Start with the scan, not the sales call.

Run the free scanner against your own domain first. If what comes back is useful, book 30 minutes and we will scope the rest.

Run a free scan →Book a scoping call