India Cybersecurity Readiness Initiative.

Six targeted, evidence-based assessments that show where your organization is actually exposed, and what to fix first. A structured response from a CERT-In empanelled auditor, in place of another generic warning.

Book a Readiness Assessment

What the initiative is

The CyberNerds India Cybersecurity Readiness Initiative is a set of six focused assessments: PHP exposure, external attack surface, credentials and APIs, digital certificates, incident readiness, and, for banking and financial services, a payments and regulatory review. Each one tests a specific risk against your real environment and ends with evidence, a prioritized fix list, and a retest. You take only the assessments that apply to you.

“Targeted assessments of the risks that apply to you — not a claim that every Indian organization is compromised.”

Five core
assessments

Each assessment answers one question with evidence: are we exposed to this risk, and if so, where exactly? Scoped individually, delivered by practitioners, mapped to the controls your auditors and regulators ask about.

01 · PHP Exposure Assessment

Identify vulnerable PHP deployments across your websites, applications, and infrastructure, including the ones nobody remembers owning.

  • End-of-life PHP versions
  • Outdated CMS & plugins
  • Vulnerable frameworks
  • Exposed admin & debug pages
  • Hosting config

02 · External Attack Surface Review

See your organization the way an attacker does: exposed assets, vulnerable services, forgotten subdomains, and publicly reachable management interfaces.

  • Asset & subdomain discovery
  • Open ports & services
  • RDP, SSH & admin panels
  • Subdomain takeover
  • Shadow IT
Ongoing attack-surface management

03 · Credential & API Security Assessment

Review exposed secrets, privileged access, API authentication, and cloud permissions — the paths most modern breaches actually take.

  • Leaked keys & tokens
  • Privileged accounts
  • API auth & authorization
  • Cloud IAM permissions
  • MFA coverage
API security testing

04 · Digital Certificate Security Review

Determine whether your certificate chains are affected by CA distrust, expiry, or weak configuration, and plan the remediation before something breaks.

  • Certificate inventory
  • Chain & CA trust
  • Expiry & renewal
  • TLS configuration
  • Shorter-validity readiness

05 · Incident Readiness Assessment

Evaluate whether you can detect, respond to, and recover from an incident — and prove what happened afterwards.

  • Detection coverage
  • Response procedures
  • Logging & retention
  • Backup recovery tests
  • Evidence preservation
Incident response

+ Payments & BFSI Regulatory Review

For banks, NBFCs, payment aggregators, and fintechs: a dedicated review of payment APIs, transaction authorization, and the regulatory requirements that apply to you.

  • Payment APIs
  • Transaction authorization
  • RBI
  • SEBI CSCRF
  • NPCI UPI
  • PCI DSS
Banking & fintech security

What each review
checks, in detail

PHP exposure

We inventory every PHP runtime we can find, internal and internet-facing, and check its version against the official support lifecycle. End-of-life branches receive no security fixes, so any known vulnerability in them stays open permanently. We then check the applications on top — WordPress, Joomla, Drupal, Laravel and custom code — for vulnerable components, exposed configuration files, and debug output.

External attack surface

Starting from your domains and IP ranges, we enumerate subdomains, certificates, cloud assets and open services, then validate what is genuinely exposed. Typical findings are forgotten staging sites, remote-desktop and database ports open to the internet, login pages for firewalls and VPNs, and DNS records pointing at resources that no longer exist.

Credentials & APIs

We search code repositories, mobile apps, and public sources for leaked keys and tokens, review who holds privileged access and whether it is protected by MFA, and test your APIs against the OWASP API Security Top 10 — broken object-level authorization, weak authentication, and excessive data exposure.

Digital certificates

We build a certificate inventory across your public and internal endpoints and check each chain for distrusted or revoked issuers, upcoming expiry, weak keys and outdated TLS. With the CA/Browser Forum cutting maximum public TLS certificate validity to 200 days from March 2026 and shorter still in later years, we also assess whether your renewal process can keep up — and recommend automation where it cannot.

Incident readiness

We test your detection and response against realistic scenarios, review the incident response plan and escalation paths, and verify that backups actually restore. We check readiness for the CERT-In directions of April 2022: reporting cyber incidents within six hours of noticing them, and retaining ICT system logs for 180 days within India.

Payments & BFSI

We test payment and banking APIs for authorization flaws, review transaction-authorization and fraud controls, and map the results to the frameworks that apply to you — RBI's cybersecurity and digital payment security controls, SEBI CSCRF, the NPCI UPI security framework, and PCI DSS — so the evidence feeds straight into your next audit.

How it works

Evidence first, then action. Every finding is proven against your environment before it reaches the report.

01

Scope

A short call to choose the assessments that apply to you and agree rules of engagement.

02

Discover & validate

Practitioners map the environment and confirm what is genuinely exposed — no unverified scanner output.

03

Prioritize

Findings rated by real-world impact, with an executive summary and a remediation plan ordered by risk.

04

Fix & retest

We support remediation, then retest to confirm each gap is closed and the evidence is audit-ready.

Who it's for

Any Indian organization that wants an evidence-based answer to "are we exposed?" — especially those with regulators, auditors, or boards asking the same question.

  • Banks & co-operative banks
  • NBFCs & fintechs
  • Payment aggregators
  • Stock brokers & DPs
  • Insurers
  • Government & PSUs
  • Healthcare
  • SaaS & e-commerce
  • MSMEs

Readiness
questions

It is a set of six targeted, evidence-based assessments from CyberNerds, a CERT-In empanelled auditor: PHP exposure, external attack surface, credentials and APIs, digital certificates, incident readiness, and a payments and BFSI regulatory review. Each one tests a specific risk against your real environment and ends with prioritized, verifiable fixes.
No. These are targeted assessments of specific, relevant risks, not a claim that any organization is compromised. Many organizations find little or nothing in some areas, and that evidence is valuable for boards, auditors, and regulators too. If we do find signs of an active compromise, we escalate to incident response immediately.
No. A short scoping call identifies which assessments apply to your environment. A business with no PHP estate skips the PHP assessment; a bank or payment aggregator adds the payments and BFSI review. Most organizations start with the external attack surface review because it shows what an attacker can already see.
No. Every engagement runs under agreed rules of engagement that define scope, off-limits systems, and testing windows. Discovery and configuration review are passive or read-only, and any active validation is controlled and scheduled with your team.
The incident readiness assessment checks your ability to meet the CERT-In April 2022 directions, including reporting incidents within six hours and retaining ICT system logs for 180 days within India. For regulated entities, the payments and BFSI review maps findings to RBI, SEBI CSCRF, NPCI UPI, and PCI DSS controls, and the evidence feeds directly into your next compliance audit.
An evidence-backed report with each finding rated by real-world impact, a prioritized remediation plan, an executive summary for leadership, and a retest to confirm that fixes closed the gaps.

Replace the warning
with evidence.

Tell us about your environment — we'll recommend the assessments that matter and skip the ones that don't.

Book a Readiness Assessment