# Security work that counts towards your compliance. Prayog Security also runs hands-on engagements. Their findings and evidence flow into the same control set, so the work is done once. - **Test and assess.** Find out where you are exposed, before an attacker or an auditor does. - **Build securely.** Put security into how your systems are designed and shipped. - **People and readiness.** Prepare the people who have to make security work when it counts. - **Govern and comply.** Run security and compliance as a programme, not a scramble before each audit. ## One piece of work, counted once. - **Scope in writing.** Every engagement starts with an agreed scope, timeline and list of deliverables, so you know what you are getting before work begins. - **Findings you can act on.** Each finding says why it matters and how to fix it, in the order that matters, with a walkthrough for the people doing the fixing. - **Evidence that counts.** We map results to one control set, so a single report or record can count towards ISO 27001, SOC 2 and the DPDP Act at once. - **A practitioner in the room.** Engagements are led by a senior security practitioner. You talk to the person doing the work. ## VAPT Test and assess · https://prayog.tech/services/vapt We test your web apps, mobile apps, APIs and networks the way an attacker would, then test again once you have fixed what we found. You get a report your developers can act on and your auditor and customers can read. ### Who it is for - A customer or partner has asked for a recent penetration test report. - You are about to launch a product or a major release. - Your audit or your regulator expects testing at least once a year. ### What you get - A report with an executive summary and every finding rated by risk, with steps to reproduce it and how to fix it - A walkthrough of the findings with your developers - A retest of the fixed findings, and an updated report - A summary letter you can share with customers once the retest is done ### How it runs 1. **Scope.** We agree what is in scope, the testing window, the accounts we need and the rules of engagement, in writing. 2. **Test.** Automated scanning, then manual testing guided by the OWASP testing guides. Anything critical is reported to you as soon as we find it. 3. **Report.** A written report and a walkthrough, with fixes in priority order. 4. **Retest.** Once you have fixed the findings, we test them again and update the report. - Typical length: One to three weeks of testing, depending on scope, then the retest. Lengths are typical. We confirm them when we agree the scope. - What we need from you: A test environment close to production, test accounts for each role, and a named contact on your side. ### Frameworks it helps with ISO/IEC 27001, SOC 2, RBI NBFC cyber directions. Auditors look for regular technical testing and proof that findings were fixed. The report and the retest are that proof. ## Application security and threat modelling Test and assess · https://prayog.tech/services/appsec We model the threats to your application, then look at how it is designed and written, not only how it behaves from the outside. We work through it with your developers, so the fixes fit how they build. ### Who it is for - Your own code handles payments, health records or other sensitive data. - You are designing a new product or a major feature and want security in the design. - Penetration tests keep finding the same kinds of bug. ### What you get - A threat model of the application: what could go wrong, where, and what stops it - Secure code review findings, with the lines of code and suggested fixes - Design recommendations, ordered by risk - A session with your developers on the patterns behind the findings ### How it runs 1. **Understand.** We walk through the architecture, data flows and riskiest features with your team. 2. **Model threats.** We map what could go wrong and where the controls should be. 3. **Review.** Manual review of the high-risk code, helped by static analysis tools, and a review of the design. 4. **Work through.** We go through the findings with your developers and agree the fixes. - Typical length: Two to four weeks, depending on the size of the codebase. Lengths are typical. We confirm them when we agree the scope. - What we need from you: Read access to the code repositories, any architecture documents, and time with a lead developer. ### Frameworks it helps with ISO/IEC 27001, SOC 2. Both expect secure development. Threat models and review records show that it happens, not only that a policy says it should. ## AI security Test and assess · https://prayog.tech/services/ai-security We assess the AI features you build into your product and the AI tools your people use: what they can reach, what they can leak and who controls them. ### Who it is for - You have shipped, or are about to ship, a feature built on a large language model. - Your teams use AI assistants and you are not sure what data goes into them. - Customers have started asking about AI in their security questionnaires. ### What you get - An inventory of the AI systems and tools in use, and the data each one touches - Test results for prompt injection, data leakage and unsafe tool use in your AI features - A review of who and what can reach your models, keys and data - An AI use policy and governance plan, if you do not have one ### How it runs 1. **Inventory.** We find where AI is built, bought or used, and what data flows through it. 2. **Test.** We test your AI features against known attack patterns, including the OWASP Top 10 for LLM applications. 3. **Review.** We review access, logging, vendor terms and how changes to models and prompts are approved. 4. **Plan.** Findings, fixes and a governance plan, in priority order. - Typical length: Two to three weeks. Lengths are typical. We confirm them when we agree the scope. - What we need from you: A test version of your AI features, the prompts and integrations behind them, and someone who knows how they were built. ### Frameworks it helps with ISO/IEC 42001, NIST AI RMF, DPDP Act 2023. The findings give you a starting point for AI governance standards, and show where personal data reaches AI systems, which matters under the DPDP Act. ## Cloud security review Test and assess · https://prayog.tech/services/cloud-security We review the configuration of your AWS, Azure or Google Cloud accounts against secure baselines, and give you a short list of fixes in the order that matters. ### Who it is for - Your cloud accounts grew quickly and nobody has looked at them as a whole. - You are preparing for an ISO 27001 or SOC 2 audit. - You have had a near miss: a public bucket, a leaked key or an unexpected bill. ### What you get - Findings against the CIS Benchmarks and your provider's own security guidance - An identity and access review: who and what can do what - A prioritised list of fixes, with the settings to change - A walkthrough with your engineers, and a recheck after the fixes ### How it runs 1. **Connect.** We read your configuration through a read-only role you create. We never need write access. 2. **Review.** We check identity, network exposure, storage, encryption, logging and monitoring. 3. **Prioritise.** We rank findings by how easily they could be used against you, not only by severity score. 4. **Hand over.** A report and a walkthrough, then a recheck once you have made the fixes. - Typical length: One to two weeks for each cloud provider. Lengths are typical. We confirm them when we agree the scope. - What we need from you: A read-only role in each account, a note of which accounts are production, and an engineer for questions. ### Frameworks it helps with ISO/IEC 27001, SOC 2, RBI NBFC cyber directions. Cloud configuration covers a large share of the technical controls auditors check, and the review records double as evidence. ## DevSecOps Build securely · https://prayog.tech/services/devsecops We build security checks into the pipelines your team already uses, sized to how often you ship, so problems are caught before release without slowing everyone down. ### Who it is for - You ship several times a week and security review cannot keep up. - Secrets or vulnerable dependencies have reached production before. - You want evidence of safe change management to come from the pipeline itself. ### What you get - Dependency, secret and container scanning in your pipelines - Infrastructure-as-code checks for Terraform, CloudFormation or similar - Release gates agreed with your team: what blocks a release and what only warns - A runbook for handling findings, and a handover session ### How it runs 1. **Map.** We look at how code moves from a commit to production today. 2. **Choose.** We pick tools that fit your stack and budget, open source where it does the job. 3. **Build.** We add the checks in stages, warning only at first, so nobody is blocked by noise. 4. **Tune.** We cut false positives, then turn on the gates your team agreed. - Typical length: Three to six weeks, done in stages. Lengths are typical. We confirm them when we agree the scope. - What we need from you: Admin access to your CI/CD system, or a developer who has it, and a few hours a week from your platform team. ### Frameworks it helps with ISO/IEC 27001, SOC 2. Pipeline logs show that every change was checked before release, which is what auditors ask about change management. ## WAF deployment Build securely · https://prayog.tech/services/waf We design, roll out and tune a web application firewall in front of your applications, so it stops attacks without blocking your real customers. ### Who it is for - Your applications face the internet with no WAF, or one that only logs. - A customer or your regulator expects one. - You turned a WAF on once and it blocked real users. ### What you get - A WAF design for your applications and provider, such as AWS WAF, Cloudflare or Azure Front Door - Rules tuned to your traffic, with every exception written down - Alerts and dashboards your team can read - A runbook for handling a block or a false positive ### How it runs 1. **Design.** We choose rule sets and where the WAF sits, and agree what must never be blocked. 2. **Watch.** The WAF runs in log-only mode first, so we can see what it would block. 3. **Tune.** We adjust the rules against your real traffic until false positives are rare. 4. **Enforce.** We switch to blocking in stages, with a quick way to roll back. - Typical length: Two to four weeks, most of it watching real traffic. Lengths are typical. We confirm them when we agree the scope. - What we need from you: Access to your DNS or CDN and cloud accounts, and a developer who knows the applications. ### Frameworks it helps with ISO/IEC 27001, SOC 2, RBI NBFC cyber directions. A tuned WAF with logs and a runbook is evidence of application protection that an auditor can check. ## Zero trust architecture advisory Build securely · https://prayog.tech/services/zero-trust We help you move from trusting anything inside the network to deciding access by identity, device and context. You get a staged roadmap your team can deliver, not a product pitch. ### Who it is for - Your team works remotely and still relies on a VPN for most access. - Contractors and partners have broad access to internal systems. - Leadership has asked about zero trust and you need a plan. ### What you get - An assessment of how identity, devices, network and applications work today - A target architecture based on NIST SP 800-207, sized to your company - A staged roadmap with quick wins first, and the effort and dependencies of each stage - Vendor-neutral advice on tools, starting with what you already own ### How it runs 1. **Assess.** Interviews and a configuration review to see how access works today. 2. **Design.** A target architecture that fits your size, not a reference diagram. 3. **Plan.** Stages ordered by risk reduction and effort, each one useful on its own. 4. **Support.** Optional check-ins as your team delivers the first stages. - Typical length: Three to five weeks for the assessment and roadmap. Lengths are typical. We confirm them when we agree the scope. - What we need from you: Time with your IT and engineering leads, and read access to your identity provider and device management. ### Frameworks it helps with ISO/IEC 27001, SOC 2, NIST CSF 2.0. Identity and access control sit at the centre of all three. The roadmap shows an auditor the plan, and each stage adds evidence. ## Security architecture review Build securely · https://prayog.tech/services/architecture-review We review how your systems are built: where the trust boundaries are, how identity and data flow, and which controls sit between them. You find out where a design choice leaves you exposed. ### Who it is for - You are planning a major change: a new platform, a migration or an acquisition. - Enterprise customers are asking detailed questions about how your system is built. - Your architecture grew in steps and nobody has reviewed it end to end. ### What you get - Architecture and data-flow diagrams, drawn or updated with you - Findings on trust boundaries, identity, data protection, logging and resilience - Recommendations ordered by risk, with the trade-offs explained - Answers you can reuse in customer security reviews ### How it runs 1. **Gather.** We read the documentation that exists and talk to the people who built the system. 2. **Map.** We draw the system as it is: components, data flows and trust boundaries. 3. **Assess.** We check each boundary and flow against secure design principles. 4. **Recommend.** A report and a working session to agree what to change first. - Typical length: Two to four weeks. Lengths are typical. We confirm them when we agree the scope. - What we need from you: Your existing diagrams and documents, and time with your architects or senior engineers. ### Frameworks it helps with ISO/IEC 27001, SOC 2, DPDP Act 2023. Data-flow diagrams and design records help with scoping and risk assessment, and show where personal data goes. ## Security awareness and phishing simulation People and readiness · https://prayog.tech/services/awareness Short training written for each role, and realistic phishing exercises. The results show where people need support, not who to blame. ### Who it is for - Your audit needs evidence of security awareness training. - Phishing and payment fraud attempts are reaching your people. - Generic training videos have not changed anything. ### What you get - Short training for your roles: engineering, finance, support and leadership - Phishing simulations based on the lures your industry actually sees - Results reported by team, with the trend over time - Completion records your auditor can check ### How it runs 1. **Plan.** We agree the roles, the topics and how results will be shared, with HR and leadership. 2. **Train.** Short sessions or modules, focused on what each role handles. 3. **Simulate.** Phishing exercises through the year, with friendly feedback the moment someone clicks. 4. **Report.** Results by team and a plan for the next round. - Typical length: Two to four weeks for a first round. Most teams then run it through the year. Lengths are typical. We confirm them when we agree the scope. - What we need from you: A list of staff and roles, approval from leadership, and permission to send test emails through your mail system. ### Frameworks it helps with ISO/IEC 27001, SOC 2, DPDP Act 2023. All three expect people to be trained. Completion and simulation records are the evidence. ## Tabletop exercises People and readiness · https://prayog.tech/services/tabletop Guided incident scenarios for your leadership and technical teams. You rehearse your response plan before you need it, and find the gaps while they are still cheap to close. ### Who it is for - You have an incident response plan that nobody has tested. - You must report certain incidents to CERT-In within six hours and want to know you can. - A new leadership team needs to know who decides what during an incident. ### What you get - A scenario built around your systems and real risks, such as ransomware or a data leak - A facilitated session, in person or online - An after-action report: what went well, the gaps and who owns each fix - Updates to your response plan and contact lists ### How it runs 1. **Prepare.** We read your response plan and choose a scenario with you. 2. **Run.** A session of two to three hours where the scenario unfolds in stages and the team decides what to do. 3. **Observe.** We note decisions, delays and missing information as they happen. 4. **Follow up.** An after-action report and changes to the plan. - Typical length: One to two weeks, including a session of two to three hours. Lengths are typical. We confirm them when we agree the scope. - What we need from you: Your current incident response plan, and the people who would be in the room for a real incident. ### Frameworks it helps with ISO/IEC 27001, SOC 2, CERT-In Directions, DPDP Act 2023. Auditors ask whether the response plan has been tested. CERT-In and the DPDP Act both set reporting duties that a rehearsal puts to the test. ## Compliance readiness Govern and comply · https://prayog.tech/services/compliance-readiness We scope your ISO 27001, SOC 2 or DPDP Act programme, find the gaps and plan the work to close them before your audit. ### Who it is for - A deal is waiting on an ISO 27001 certificate or a SOC 2 report. - You process personal data in India and need to understand your duties under the DPDP Act. - You are not sure which framework to start with. ### What you get - A scope statement: which systems, teams and locations are in - A gap assessment against the framework, with each gap explained - A remediation plan with owners, effort and dates - Policy and procedure templates where you have none ### How it runs 1. **Scope.** We agree the framework, the parts of the business in scope and your target audit date. 2. **Assess.** Interviews, document review and configuration checks against the framework. 3. **Plan.** Gaps ranked by risk and effort, with a realistic timeline to your audit. 4. **Support.** Optional help as you close the gaps, up to the audit. The certificate or report itself comes from an independent auditor. - Typical length: Two to four weeks for scoping and the gap assessment. Lengths are typical. We confirm them when we agree the scope. - What we need from you: Your existing policies, a list of systems and vendors, and time with the people who run them. ### Frameworks it helps with ISO/IEC 27001, SOC 2, DPDP Act 2023. This is the core of readiness for all three. We map the work to one control set, so evidence gathered once can count towards more than one framework. ## Virtual CISO Govern and comply · https://prayog.tech/services/vciso Part-time security leadership for teams that need a security lead but not yet a full-time one: a named person who owns the roadmap, the policies and the answers to customer security reviews. ### Who it is for - Customers send security questionnaires and nobody owns the answers. - Your board or investors want regular security reporting. - You need a security strategy but cannot yet justify a full-time hire. ### What you get - A security roadmap for the next twelve months, reviewed each quarter - Policies written for how your company actually works - Board and leadership reporting - Answers to customer security questionnaires and reviews - A named contact for security decisions and incidents ### How it runs 1. **Assess.** A first month to understand the business, its risks and what exists today. 2. **Plan.** A roadmap and priorities agreed with leadership. 3. **Run.** A set number of days each month on the roadmap, reviews and questions. 4. **Report.** A short monthly update and a quarterly review with leadership. - Typical length: Six or twelve months, with a set number of days each month. Lengths are typical. We confirm them when we agree the scope. - What we need from you: A sponsor in leadership, access to the people and systems in scope, and a seat at the meetings where security comes up. ### Frameworks it helps with ISO/IEC 27001, SOC 2, DPDP Act 2023. A virtual CISO can own your compliance programme from readiness through the audit, and in the years after it. ## Not sure which one you need? Tell us what is in the way: a deal, an audit date or a question from your board. We will suggest where to start. hello@prayog.tech