Frequently asked questions

Request an assessment or contact us. We begin with a short scoping call to understand your goals, environment and timelines, and then send you a clear, fixed-scope proposal.

No. Sharing your request and the first scoping conversation come with no cost and no obligation. You only commit once you accept a written proposal.

Yes. We are happy to sign a mutual NDA before detailed discussions, and an NDA is always in place before we access any of your systems.

Yes. Tell us what is driving the need, such as an audit, a customer request or a new launch, and we will recommend the right service, or combination of services, during the scoping call.

Cost depends on the scope, the complexity of your environment and the time the work needs. You receive a clear, fixed-scope proposal with the cost before any work starts.

Once the scope is agreed, most engagements can usually be scheduled within a few weeks, depending on the service and your preferred testing windows.

A vulnerability assessment finds and ranks known weaknesses across your systems. A penetration test goes further: experienced testers safely try to exploit weaknesses to prove what an attacker could actually do. Our VAPT service combines both.

Every engagement is planned to avoid disruption. We agree testing windows, rules of engagement and stop conditions in advance, avoid destructive techniques and stop immediately if anything unexpected happens.

Most organisations test at least once a year and after major changes, such as a new application, a new API or a significant change to their infrastructure. Many also test before major releases.

Yes. We retest fixed findings to confirm they are closed, so your final report reflects your current position.

An executive summary for leadership, detailed findings with risk ratings and evidence, clear fix guidance for your teams, retest results and a letter of attestation you can share with customers and partners.

No. ISO 27001 certificates are issued by accredited certification bodies, and SOC 2 reports are issued by independent auditors. We prepare you for the audit, from gap assessment to evidence and readiness.

Yes. Our reports are structured to support evidence for ISO 27001, SOC 2, PCI DSS and customer security reviews. The final audit or compliance decision always rests with your auditor or assessor.

Some regulations require audits by specifically approved or accredited firms. ThreatGaurd provides independent testing, readiness and advisory services, and we tell you upfront if a requirement needs an approved auditor, so you can plan for it.

We map our work to frameworks such as ISO 27001, SOC 2, PCI DSS, NIST CSF, CIS Controls, the India DPDP Act, GDPR and HIPAA, as well as sector frameworks that apply to your organisation.

We review and test environments on Amazon Web Services, Microsoft Azure and Google Cloud, including multi-cloud setups, identities and Kubernetes and container platforms.

VAPT is a point-in-time test where experts try to exploit weaknesses. Managed vulnerability management is an ongoing service that continuously finds, prioritises and tracks vulnerabilities until they are fixed. Many organisations use both.

A virtual CISO is an experienced security leader who provides CISO-level leadership on a flexible basis. They set strategy, run your security programme, report to leadership and guide your teams, without a full-time hire.

An NDA is signed before any access. We use only the access the work needs, collect only the evidence needed to prove a finding, deliver reports securely and share them only with named contacts.

Yes. We use test accounts and test data wherever possible, avoid copying or downloading real records and show only the minimum evidence needed to prove a finding.

Engagement data is deleted after the engagement, unless a different retention period has been agreed with you in advance.

Yes. We are based in India and work with clients globally. Each engagement is scoped to the regulations and frameworks that apply where you operate.

Yes. We coordinate access and testing windows with your IT provider, system integrators or hosting partners, and give them clear, prioritised fixes they can act on.

Please follow our Security Disclosure policy and email the details to contact@threatgaurd.com. Do not test systems that belong to our clients or partners.

Open roles are listed on our Careers page, and you can also send a general application. ThreatGaurd never asks for any payment during recruitment.