BFSI & Digital Payments · client anonymised
Continuous Web & API Security Testing for a large Indian bank
Client profile
- One of India's largest, most highly regulated banks with a nationwide internet and mobile banking footprint
- Client identity withheld per NDA
- Engaged as part of an RBI supervisory review cycle
Engagement scope
- Fortnightly black-box + grey-box VAPT
- Internet banking, mobile banking APIs and admin console
- OWASP Top 10 + API Top 10 + business-logic abuse cases
- 12+ month retained engagement, extended from an initial pilot
Notable themes
Broken object-level authorisation on payment APIs, session handling gaps, weak OTP rate-limiting.
Business outcome
All Critical/High findings closed inside a 7-day SLA. The bank sustained continuous assurance through its supervisory review and extended AuditSync from a pilot into a standing security partner.
Find your broken locks before someone else does.
Tell us what you need tested. We reply within one business day.