One SaaS Product, Two Kinds of Buyers
A Bengaluru HR-tech company has two big deals closing in the same quarter. A UK bank sends a vendor questionnaire. Question 14 asks whether a CREST-accredited company ran the last penetration test.
The same week, an Indian listed broker asks for a VAPT report from a CERT-In empanelled auditor. The broker is a SEBI-regulated entity, so it has no choice.
The founder’s last test came from a vendor with no credentials. Now she faces two new tests, two scopes, two reports and two invoices.
Here’s the short answer. Neither credential is legally required to export software.
CREST is an international quality standard that independently checks the testing firm itself. CERT-In empanelment is India’s government list of auditors that Indian regulators and public bodies accept. A firm holding both credentials can use one test to serve both kinds of buyers.
That’s why a CREST-accredited, CERT-In-empanelled company makes sense for exporters with customers on both sides.
This guide covers what each credential checks, where each one is required, how global frameworks treat the tester, how to verify a firm’s claims, and how to plan one engagement for both markets.
CREST and CERT-In at a Glance
The two credentials answer different questions, so start with a side-by-side view.
CREST accreditation is an independent assessment of a testing company’s processes, methods, data handling and staff. CERT-In empanelment is the Indian government’s approval of an auditing organisation to carry out security audits for Indian entities. One speaks to overseas procurement. The other speaks to Indian regulators.
| CREST accreditation | CERT-In empanelment | |
|---|---|---|
| Who runs it | CREST, an international not-for-profit body formed in 2006 (VikingCloud) | CERT-In, India’s national cyber agency under MeitY |
| What it covers | The company, one discipline at a time (CREST) | The auditing organisation |
| What it assesses | Policies, procedures, methodology, data security, staff competence | Technical capability, manpower and compliance with CERT-In’s audit rules |
| Where to check | CREST Marketplace | CERT-In’s empanelled list |
| Who asks for it | Overseas enterprise buyers; schemes such as CBEST, CHECK, TIBER-EU and iCAST | SEBI, government departments, public tenders |
| Company or person | Company accreditation, plus separate individual certifications | Organisation only |
What CREST Accreditation Actually Checks
Overseas buyers trust CREST because someone outside the testing firm has looked inside it.
Company accreditation and individual certification differ. CREST accredits companies. It certifies people. Testers sit exams such as the CREST Registered Penetration Tester (CRT) and the CREST Certified Tester for infrastructure or applications (CCT INF, CCT APP) (CREST certifications).
A firm can employ CRT holders without holding accreditation itself. So a buyer who asks for “a CREST accredited company” wants something different from “CREST certified testers”.
What the assessment covers. CREST reviews governance, security controls, service methodology, data handling and staff competence, and it reassesses members periodically (CREST accreditation).
Accreditation runs per discipline. Penetration testing, vulnerability assessment, threat intelligence, incident response and SOC services each carry their own accreditation. A firm accredited for penetration testing hasn’t necessarily earned accreditation for incident response.
Buyer protection. Members sign up to CREST’s codes of conduct, and buyers can raise a complaint with CREST itself. A standard vendor offers no such outside route.
How to read a Marketplace listing. The listing shows the legal entity, its location and each accredited discipline. If the service you’re buying doesn’t appear under that entity, the badge on the website doesn’t cover your test.
Ask the firm when CREST last reassessed it. A recent date tells you the processes CREST reviewed are the ones the firm runs today.
In short, CREST tells an overseas buyer that the firm has passed an independent check, not just that its staff passed exams.
What CERT-In Empanelment Means and Where It’s Required
When a regulated or government customer in India comes to your pipeline, CERT-In empanelment becomes important.
CERT-In enlists organisations that conduct information security audits. Both these auditors and the organisations they audit are subject to the Comprehensive Cyber Security Audit Policy Guidelines (v1.0, 25 July 2025). CERT-In does not certify products, nor does it issue VAPT certificates.
The list is self-explanatory. On 4 November 2026, when we checked CERT-In’s official list, it had 228 organisations (CERT-In). There is no publication date or validity date per record in the PDF. So ask the firm for its empanelment letter and verify that the validity covers the date on which it signs your report.
Indian customers require an empanelled auditor in four common situations:
- SEBI-regulated entities. The CSCRF requires a CERT-In empanelled auditor for external VAPT (Cyril Amarchand Mangaldas summary).
- Government websites and apps. A safe-to-host audit under GIGW 3.0 can come from NIC, STQC or a CERT-In empanelled auditor.
- Government tenders. Public buyers routinely name empanelment as an eligibility condition.
- Banks. RBI’s 2026 Directions for commercial banks apply CERT-In’s audit guidelines where the auditor is empanelled (para 159). RBI doesn’t make empanelment compulsory for every bank test.
Empanelment also changes how the audit runs. Under the 2025 guidelines, the auditor must:
- Keep audit data in India and give you a wipe-out certificate when the retention period ends (section 10.3);
- share audit information with CERT-In within 5 days of finishing (section 10.6);
- record the application’s version, hash and timestamp in the report (section 9.5(i));
- score findings with CVSS, supplemented by EPSS (section 16.2(ii)).
Overseas buyers rarely ask for these details. Indian regulators expect them.
Some CERT-In rules apply to every Indian SaaS company anyway. The April 2022 Directions require incident reporting within 6 hours, 180 days of logs kept in India, and clock sync to NIC or NPL servers (Trilegal).
Why Indian SaaS Exporters Sit Between Two Rulebooks
Indian SaaS sells abroad first, but it rarely sells only abroad.
Bain’s India SaaS Report put the sector at about USD 12 to 13 billion in annual recurring revenue in 2022. It projected USD 35 billion by 2027, close to 8% of the global SaaS market (Business Standard).
Overseas buyers send security questionnaires, ask for SOC 2 or ISO 27001 evidence, and write contract clauses that call for an “accredited” or “independent” tester.
Indian buyers bring different demands. Brokers, banks and insurers answer to SEBI, RBI or IRDAI. Government departments need safe-to-host audits. DPDP due diligence adds its own questions.
Timing worsens it. SEBI-regulated customers work to fixed submission dates set by the exchanges and depositories. Overseas deals close on their own calendar. Two vendors mean two testing windows, and your engineers fix the same bug twice under two deadlines.
A split approach costs more than it looks:
- two vendors, two scopes and two reports;
- findings that don’t match between the reports;
- Retests done twice, on two timelines.
So the real problem isn’t picking a credential. It’s paying for the same test twice.
SaaS Application Security Audit Gold Standard: What the Dual Credential Gives You
“Gold standard” here means one assessed testing firm whose single report both overseas procurement and Indian regulators accept.
That’s the practical SaaS application security audit gold standard: one scope, one test team and one set of findings, written up in the formats each buyer reads.
| Factor | Single-credential vendor | Dual-credential partner |
|---|---|---|
| Overseas buyer acceptance | Only if CREST accredited | Yes |
| SEBI and government acceptance | Only if CERT-In empanelled | Yes |
| Methodology checked by an outside body | Only with CREST | Yes |
| India data handling rules | Applies only if empanelled (storage in India, wipe-out certificate, section 10.3) | Yes |
| Tests needed per cycle | Often two | One |
| Report formats | One | Global format plus CERT-In and regulator fields |
| Retest evidence | Separate per vendor | One closure record |
Think about who reads the report. An overseas security reviewer looks for the tester’s accreditation, the scope, the severity of open findings and proof of retest. An Indian regulator’s reviewer looks for empanelment, the tested build and environment, and the CERT-In report fields. A dual-credential report answers both readers in one document.
The test itself has to match how SaaS fails. A strong scope covers:
- tenant isolation and cross-tenant data access (BOLA and IDOR);
- authentication, session handling and SSO;
- API authorisation, endpoint by endpoint;
- cloud configuration and IAM;
- secrets in CI/CD pipelines;
- admin and support consoles.
Be honest about the limits. A credential sets a floor, not a ceiling. Scope, the named testers and the retest still decide whether you meet the SaaS application security audit gold standard or just carry two logos.
Global Compliance Frameworks VAPT India: How Each Framework Treats the Tester
Most frameworks ask for testing. Very few name an accredited tester.
That’s the key finding for anyone mapping global compliance frameworks VAPT India teams face in export deals. CREST and CERT-In matter because buyers and specific schemes ask for them, not because SOC 2 or ISO 27001 does.
| Framework | Testing required? | Accredited tester required? | What CREST or CERT-In adds |
|---|---|---|---|
| SOC 2 (AICPA) | Not named; often used as evidence | No; a licensed CPA firm issues the report | Credible evidence for the auditor |
| ISO/IEC 27001:2022 (ISO) | Annex A 8.8 and 8.29 cover vulnerabilities and security testing. | No; an accredited body issues the certificate. | Independent test evidence |
| PCI DSS v4.0.1, Req. 11.4 (PCI SSC) | Yes, at least every 12 months and after significant change. | A qualified, independent tester; it needn’t be a QSA or ASV (Strike summary) | Proof of qualification |
| GDPR Art. 32(1)(d) (EUR-Lex) | Regular testing of security measures | No | Defensible test records |
| HIPAA, 45 CFR 164.308(a)(8) (eCFR) | Periodic technical evaluation | No | Defensible test records |
| EU DORA (EUR-Lex) | Threat-led testing for in-scope financial entities | Tester requirements sit in the TLPT technical standards. | Relevant when a client is an EU financial entity |
| CBEST, CHECK, GBEST, TIBER-EU, iCAST, DESC | Scheme-based testing | CREST supports each scheme (CREST); check each scheme’s own rules. | Often the entry ticket |
| SEBI CSCRF | Yes | A CERT-In empanelled auditor | Required |
| GIGW 3.0 safe-to-host | Yes | NIC, STQC or a CERT-In empanelled auditor | Required for government hosting |
Two practical points follow. A SOC 2 auditor or an ISO 27001 certification body will accept a good test from a qualified independent firm. An accredited tester simply makes that evidence harder to question.
PCI DSS goes further than most people expect in the other direction. It asks for qualification and organisational independence, and it says plainly that the tester needn’t be a QSA or ASV.
Read the table from your customer’s side. A UK bank client may route you through its CBEST-minded procurement team. An Indian broker client has no flexibility at all.
For details on each regulatory scheme, see our CREST vs CHECK vs CBEST vs TIBER-EU vs DORA TLPT comparison.
Mapping global compliance frameworks VAPT India exporters meet tells you which credential each deal needs before procurement asks.
CREST Certified Penetration Testing Vendors India: How to Verify Both Claims
Search for CREST-certified penetration testing vendors in India, and you’ll find lists that mix accredited firms, firms with certified staff, and firms with neither. Follow these steps instead:
- Search the CREST Marketplace by the firm’s legal name. Confirm that the discipline is penetration testing.
- Search CERT-In’s list for the same legal name.
- Ask for the CERT-In empanelment letter. Check that its validity covers the date the firm will sign your report.
- Ensure that the company listed on your contract and invoice is the same as the entity on both lists.
- Ask for the names of the testers and their individual certifications.
- Confirm the firm won’t sublet the work. CERT-In’s audit guidelines prohibit this (section 10.5(vii)).
- Read how the firm describes its empanelment. CERT-In allows only its wording and bans its logo (section 10.5).
What if your preferred firm holds only one credential? You can still avoid a double test. Agree on one scope document, share it with both firms, and ask the second firm to validate rather than repeat the first firm’s work. It costs more than a single firm, but less than two full tests.
Watch for loose wording too. “CREST certified company” mixes up company and person. CERT-In does not certify anything. And “CREST accredited by CERT-In” is simply wrong, because CERT-In has no role in CREST.
Several Indian firms do appear on both registers. Verify each one yourself rather than trusting any published list of CREST-certified penetration testing vendors in India, including ours. For the CREST half of the check-in, in more depth, see how to verify a CREST-accredited company.
Verify the legal entity on both registers, and you’ve done most of the work.
Red Flags When a Vendor Claims Both
| Red flag | What it usually means | What to ask for |
|---|---|---|
| Badge with no Marketplace link | Accreditation may have lapsed or never existed. | The CREST Marketplace URL |
| CERT-In claim with no letter | Empanelment may have expired or belong to someone else. | The letter and its validity dates |
| The trading name differs from the listed entity. | A sister company holds the credential. | The legal name on both registers |
| Accredited discipline doesn’t match the service. | Accredited for one service, selling another | The discipline shown on the Marketplace |
| Scan-only report | No manual testing | Sample findings with manual steps |
| Testers not named | Possible subcontracting | Named testers and their certifications |
| No regulator format | The report won’t satisfy SEBI or a government buyer. | A sample in the regulator’s format |
A note from our testing team. The mismatch I see most often involves group structures.
A client buys a test from the overseas arm of a security group. The CERT-In empanelment belongs to a different Indian entity in the same group. The report looks right, but the Indian regulator can’t accept it, and the client pays for a second test.
Planning One Engagement That Serves Both Markets
One scope and one test can produce every output you need, if you plan it that way from the start.
- List your buyers and what each one asks for.
- Build one scope: web app, APIs, mobile, cloud and tenant isolation.
- Confirm both credentials before you sign.
- Agree on the report outputs: a global format, plus SEBI Annexure-A or CERT-In’s 2025 report fields where an Indian regulated customer needs them.
- Write the number of retest rounds into the contract.
- Record the build version, hash and test environment.
- Collect the attestation letter once the tester has verified your fixes.
- Map findings to SOC 2, ISO 27001 and other controls for your trust centre.
Work backwards from your hardest deadline. If an Indian regulated customer has a fixed submission date, set the test window at least six weeks before it. That leaves time for fixes, a retest, and the customer’s own committee approval.
Our companion guides cover the details: the true cost of a CERT-In audit (scope and retest terms) and how to prepare a CERT-In-compliant VAPT report for RBI and SEBI (report formats).
One scope, one test, several outputs.
How Qualysec Supports SaaS Exporters
Qualysec is a specialized penetration testing company, and SaaS exporters make up much of our work.
Qualysec holds CREST accreditation for penetration testing, which it announced in July 2026. We scope SaaS tests around tenant isolation, APIs and cloud, and we map each finding to SOC 2, ISO 27001, PCI DSS and the other frameworks your overseas buyers name.
Retests come within each plan’s published limits, from one retest within a month on the Starter plan to unlimited retests on Business and Enterprise plans (Qualysec pricing). The growth plan adds a letter of attestation, which overseas buyers often ask for.
Where an Indian regulator or government buyer needs a CERT-In empanelled auditor, confirm the auditor on CERT-In’s list before you sign. That rule applies to every vendor, including us.
Case study: enterprise software, web apps and APIs
Unvired Inc., a Houston-based provider of AI-powered enterprise software, worked with us from June to September 2025. As their verified Clutch review describes, we ran automated and manual VAPT across their web applications and APIs, then retested. They remediated every identified vulnerability, and our retest verified each fix, with no critical or high issues left open. The engagement ended with security compliance certificates their customers could rely on.
Conclusion and Next Steps
CREST opens overseas procurement. CERT-In opens Indian regulated and government buyers. If you sell to both, one firm that holds both, verified by its legal name on each register, saves you from paying twice for the same test.
Neither credential guarantees a reliable test on its own. The scope, the named testers, and the retest are still the most important factors.
Your next step: write down what each of your current and target buyers asks for. Then check any shortlisted vendor on both registers before you request a quote.
One scope, one test and reports your overseas and Indian buyers will both read. Talk to our team about a CREST-accredited penetration test scoped for your SaaS product, with findings mapped to the frameworks your customers ask for.
Want to see the report your buyers would receive? Review a sample penetration testing report, with severity, reproduction steps, retest results and framework mapping.
Frequently Asked Questions
Which companies are actively empanelled with CERT-In in 2026?
CERT-In publishes the only reliable list. It showed 228 organisations when we checked on 4 November 2026. Search it by the firm’s legal name, then ask the firm for its empanelment letter. Check that the letter’s validity covers the date it will sign your report, because the list itself shows no dates.
Why should an Indian SaaS exporter hire a CREST-accredited and CERT-In empanelled company?
One firm with both credentials can run a single test that overseas buyers and Indian regulated or government customers both accept. That saves a second test, a second scope and a second retest cycle. You also get a methodology and data handling process that an outside body has checked, which helps in security reviews.
What is the difference between a standard VAPT vendor and a CREST-accredited partner?
CREST assesses an accredited partner’s processes, methodology, data handling and staff competence, then reassesses them periodically. Buyers can also complain to CREST directly. A standard vendor may employ skilled testers, but nobody outside the firm has checked how it works, and you have no recourse beyond the contract.
