Frequently Asked Questions

CyberrGuard is an offensive security company. We test applications, APIs, AI systems, cloud and live infrastructure the way real attackers would, then help you fix what we find and prove it to regulators.

We are based in Noida, India, and serve enterprises worldwide. We are especially strong where Indian or GCC regulation applies, because our reports map directly to those frameworks.

Our services are designed for enterprises and regulated organisations, where scope, evidence and accountability matter most.

No. We do not place staff in your team and we do not run 24×7 monitoring. We test, prove and help you fix.

Five guardrails on every engagement: written authorisation, agreed scope, sandbox isolation, technical controls such as rate limits and spend caps, and full accountability under one contract.

Vetted CyberrGuard security specialists selected for your technology. CyberrGuard is always your single contractual counterparty.

Most testing happens on a sandbox copy in Enclave Lab. Live testing follows agreed windows, rate limits and off-limits actions, with your team informed throughout.

Not in sandbox testing, which uses masked and synthetic data. For live work, we use dedicated test identities and accounts.

A short scoping call, a written scope and rules of engagement, testing in Enclave Lab or on authorised live targets, then a report walkthrough and a retest once you have fixed the findings.

OWASP Top 10:2025, OWASP API Security Top 10 (2023), OWASP Top 10 for LLM Applications (2025), OWASP Top 10 for Agentic Applications (2026), MITRE ATLAS and CIS Benchmarks.

CERT-In directions, RBI guidelines, SEBI CSCRF, the DPDP Act, ISO 27001 and PCI DSS, plus SAMA, NCA and other GCC frameworks.

It depends on scope. A private hackathon runs over a fixed window such as 48 hours; we confirm the timeline for every other engagement in writing during scoping.

Pricing follows scope: applications, APIs, user roles, depth and environment. After a scoping call you receive a fixed quote.

Yes. Many clients begin with a single application VAPT or a Vulnerability Disclosure Programme and expand from there.

Yes. Every engagement closes with a retest that confirms each fix holds.

CyberrGuard's isolated testing sandbox. We run a copy of your system there with masked and synthetic data, so we can attack it without touching production.

Docker, AMI or VM images, code repositories, pre-production endpoints, firmware images, AI application builds and infrastructure-as-code.

Call Cyber911 on +91 87672 63110 or email info@cyberrguard.ai. Preserve logs, avoid wiping affected systems, and note when you first noticed the incident: CERT-In's six-hour reporting clock starts then.

A vulnerability assessment finds and lists known weaknesses. A penetration test exploits them to show real business impact. VAPT does both.

No. We test a copy of your system in Enclave Lab using masked and synthetic data.

A Docker, AMI or VM image, a firmware image, a code repository or a pre-production endpoint, plus a short scoping call.

A penetration test finds as many vulnerabilities as possible in a defined scope. Red teaming pursues a specific goal across your whole organisation, the way a real attacker would.

Our attackers and your defenders work together, so your team learns to detect and stop each technique in real time.

No. Cloud reviews use a read-only role. Any live attack simulation happens only with your explicit authorisation.

Adversarial testing of an AI system: trying to make it leak data, break its rules or take unsafe actions, so you can fix those weaknesses first.

Any AI tool employees use without approval. It can quietly send confidential company data to outside services.

Yes. Our AI Red-Teaming Challenges include jailbreak, prompt injection and data-extraction attacks in Hindi, Hinglish and regional languages.

A bug bounty rewards ethical hackers for confirmed vulnerabilities. In a managed programme, CyberrGuard runs design, researcher selection, triage and rewards for you.

A VDP is an open channel for anyone to report issues, usually without rewards. A bug bounty rewards selected researchers for valid findings.

Hackathons run on a sandbox copy with synthetic data. Live programmes use dedicated test accounts under agreed rules.

CERT-In's 2022 directions require covered organisations to report specified cyber incidents within six hours of noticing them.

A pre-signed agreement that lets our responders start the moment you call, instead of negotiating terms during an attack.

The Digital Personal Data Protection Act is India's law governing how organisations collect, process and protect personal data.

SEBI's Cybersecurity and Cyber Resilience Framework sets cybersecurity requirements for SEBI-regulated entities.

A structured set of findings, controls and proof, organised so auditors and regulators can review it directly.

An isolated environment that simulates real systems, so people can practise attacking and defending them safely.

A certification shows someone once passed an exam. A skills audit measures what each person can do today, on realistic challenges.

A guided, discussion-based rehearsal of a cyber attack that tests your team's decisions and reporting steps.

Soon. Request early access on the For Hackers page and we will email you when registration opens.

No. The practice platform has graded challenges for every level, and your CyberrScore grows as you improve.

CyberrGuard's skill rating for security researchers, built from verified performance: confirmed findings, hackathon results, practice challenges, specialisations and conduct.

After a one-time identity verification, rewards for valid findings and hackathon prizes are paid through the platform, with tax paperwork handled for you.

Verification lets organisations trust private events and lets us pay rewards correctly.