Managed Bug Bounty, Private Hackathons and Disclosure Programmes

Sponsored and Private Hackathons

Vetted security researchers compete to break a copy of your application over a short, fixed window, such as 48 hours. Many testers in parallel uncover a far wider range of issues than one tester can, and your live systems are never touched.

AI Red-Teaming Challenges focus on jailbreaks, prompt injection and data extraction, including attacks in Hindi, Hinglish and regional languages.

How It Works

1. We agree scope, rules and reward pool with you.
2. We deploy a copy of your application in Enclave Lab with synthetic data.
3. We select researchers whose skills match your technology.
4. We run the event with live monitoring and a leaderboard.
5. We triage, de-duplicate and rank every finding.
6. You get a report with fixes, and we retest once fixes are made.

Managed Bug Bounty

An ongoing, private programme where selected security researchers test your live systems and are rewarded only for valid, confirmed vulnerabilities. We run everything: design, researcher selection, triage and rewards. You pay a management fee plus rewards for confirmed findings.

How It Works

1. Scope, reward levels and rules of engagement, with written authorisation and safe harbour.
2. Dedicated test accounts, rate limits and off-limits actions.
3. A small, select group of researchers first, expanding over time.
4. Every report triaged; only confirmed issues reach you.
5. All rewards managed on your behalf.
6. Fixes retested, results shared monthly.

Vulnerability Disclosure Programme

A VDP is a safe, published channel where anyone can report security issues in your systems. It is a low-cost starting point for banks, PSUs and government bodies, and a natural step up to managed bug bounty.

1. We draft and publish your disclosure policy and security contact page.
2. We set up a secure reporting channel.
3. We triage incoming reports and confirm real issues.
4. We coordinate fixes and keep the reporter updated.
5. We align the process with CERT-In and NCIIPC disclosure channels.

Triage as a Service

Running your own disclosure or bounty programme? Our team checks, de-duplicates and prioritises every incoming report within an agreed timeframe, so your engineers see only real, reproducible issues.

1. We connect to your reporting channel.
2. We reproduce each report and confirm whether it's real.
3. We remove duplicates and rate severity.
4. We pass confirmed issues to you with clear fix guidance.
5. We report against agreed response times every month.

Supplier Security Testing

Banks and regulated companies rely on hundreds of suppliers and must check their security under RBI and SEBI third-party rules. We test many suppliers in parallel, to one standard scope, and you receive one consolidated report.

1. A standard test scope, usually external and non-intrusive.
2. Written authorisation from each supplier, usually through your contracts.
3. Suppliers tested in parallel.
4. All findings validated centrally.
5. A consolidated risk view, plus an individual report per supplier.

AI-Assisted Pentesting

AI tools scan quickly and broadly. Our specialists then confirm every finding, chase the complex attack paths tools miss, and sign off the report. Faster coverage, without losing human judgement.

1. We choose the best-suited AI testing tool for the job.
2. Automated scans run in Enclave Lab or against agreed live targets.
3. Specialists verify every result and remove false positives.
4. Specialists manually test business logic and chained attacks.
5. You get a human-signed report.