Annual Security Program
Bundle your pentest, VAPT, code review, configuration audits and tabletop exercises into a single 12-month program with a quarterly cadence — at a 25–35% discount to one-off pricing. Audit-evidence-ready, board-reportable, regulator-defensible.
- Quote SLA48 hours
- Typical engagement5–15 working days
- RetestFree within 30 days
- Reporting formatCERT-In + ISO + SOC 2 ready
- Team100% in-house · OSCP / OSWE / OSEP
A Annual Program engagement, in plain language.
The annual security program replaces the panic-driven one-off engagement cycle. We sit with your CISO, map the 12-month assessment plan against your regulatory deadlines (RBI System Audit, SEBI CSCRF, CERT-In, ISO 27001 surveillance, SOC 2 Type 2), and execute on a rolling quarterly cadence. Findings flow into a single risk register. Remediation gets chased between quarters. Free retests are unlimited within the contract window. Your board sees one trend chart, not 11 disconnected PDFs.
- 25–35% lower spend vs. one-off engagement pricing across the same scope
- Single risk register across pentest + audit + code review + tabletop findings
- Regulator-defensible evidence package — no last-minute scramble before audit
- Continuous remediation chasing (we don't just hand over a PDF and disappear)
- Quarterly board / risk-committee deck produced for you
Phased delivery — every step documented.
Interactive walkthrough of how we run a Annual Program engagement — tap a phase to expand its activities.
1 · Annual scoping & roadmap
- 01Regulatory calendar mapping (RBI · SEBI · CERT-In · ISO · SOC 2 · PCI-DSS)
- 02Asset + product roadmap intake
- 0312-month assessment cadence designed jointly with your CISO
- 04Risk-register baseline established
Industry-standard + custom.
We use the same tooling top BFSI red teams operate — combined with Macksofy in-house extensions and proprietary scripts where commercial tools fall short.
Sectors we operate in
What you get
- 12-month assessment roadmap aligned to your regulatory calendar
- Quarterly execution: pentest · VAPT · code review · audit · tabletop
- Single consolidated risk register (Macksofy platform)
- Quarterly business review + board-ready trend chart
- Unlimited free retests within the contract window
- Year-end auditor evidence package (CERT-In · RBI · SEBI · ISO · SOC 2)
- Annual maturity assessment (NIST CSF + ISO 27001 alignment)
Anonymized engagement snapshots.
Scope · 12-month program: 4 pentests + 2 code reviews + 1 red team + 4 audits
Finding: Consolidated savings of ₹68 L vs. one-off pricing; closed 91% of High/Critical findings inside the contract window
Material — passed IRDAI System Audit + ISO 27001 surveillance with zero major non-conformities
Scope · 12-month program for SEBI CSCRF + RBI master direction readiness
Finding: Found 3 Critical issues in pre-prod that would have triggered SEBI CSCRF non-conformity; remediated before go-live
High — avoided regulatory delay of new investment platform launch
One contract. Twelve months of assurance.
Annual program pricing runs ₹40 L–₹2.5 Cr per year depending on asset count, product portfolio and regulatory footprint — at a 25–35% discount vs. one-off engagement pricing. Quote within 5 working days of scoping.
Rated 4.9 ★ from 612 client reviews.
“We've worked with three Big 4 firms before Macksofy. None found what their team did in our payments stack. The most actionable report we've received in a decade.”
“The CHFI training Macksofy delivered for our cyber cell raised investigation quality measurably. Practical, India-context-aware, and respectful of our operational realities.”
“Came in with zero security background. 5 weeks later I was running Burp Suite and Metasploit confidently. Cleared CEH on the first attempt.”
Things people ask before signing.
Often paired with this engagement.
Get a fixed-price proposal in 48 hours.
Tell us about your security need — pentest, audit, training or a wider engagement. A senior consultant will reply within a few business hours.
- CERT-In Empanelled
- EC-Council ATC · CompTIA Authorized
- 20,000+ professionals trained
- India + UAE engagements