Get started
Get audit-ready for RBI and PCI DSS.
Book a free scoping call. Share your products and PCI scope, and get a clear plan and a fixed quote.
+91 98183 63944RBI’s Payment Aggregator Directions (2025) ask for regular VAPT, PCI DSS compliance and an annual cyber security audit by a CERT-In empanelled auditor. We pentest your checkout, payment APIs, merchant dashboards and card data environment to PCI DSS 11.4, help your team fix every finding, and arrange the CERT-In empanelled audit report through our partner.
Share a few details and get clear next steps, a timeline and a fixed quote.
In payments, the costly bugs are in the logic: a webhook that marks an order paid without checking the signature, a refund that runs twice, or a merchant who can see another merchant’s settlements. We test these flows by hand alongside segmentation, cloud and infrastructure checks, and map every finding to RBI and PCI DSS requirements.
| SCANNER ONLY | XTREME INFOSEC | |
|---|---|---|
| Known vulnerability scan | ✓ | ✓ |
| Payment, refund & payout logic testing | ✕ | ✓ |
| Webhook & callback tampering tests | ✕ | ✓ |
| CDE segmentation testing | ✕ | ✓ |
| Findings mapped to RBI & PCI DSS | Limited | ✓ |
or call +91 98183 63944
Pick an area to see what we check — and a typical finding.
Hosted checkout, payment pages and JS / mobile SDKs.
Payment, refund, payout and settlement APIs.
Bank, network and merchant callbacks.
Merchant onboarding, KYC and dashboards.
Card data environment, network segmentation and cloud.
Reports for RBI audits and your PCI assessor.
Share your products, PCI scope and RBI audit dates. We sign an NDA first.
We agree a written PCI DSS 11.4 method: CDE perimeter, application and network layers, and segmentation.
Manual testing on sandbox or production in agreed windows, using test merchants and small amounts.
Every finding with its risk and exact fix, in a format your PCI assessor and auditors can use.
We retest every fix; where a CERT-In empanelled report is needed, our partner verifies and issues it.
Tell us your licence type and PCI scope, and we’ll send a fixed quote.
Your checkout and payment APIs.
The full PCI DSS 11.4 scope.
Testing for every release and audit cycle.
Want a quick ballpark for the testing first? See typical VAPT prices →
“Their penetration testing methodology was thorough and aligned with OWASP standards. The final report was detailed, actionable, and easy for our developers to understand.”
“Xtreme InfoSec identified critical vulnerabilities that other vendors missed, with excellent remediation support.”
Yes, for the annual system and cyber security audit under RBI’s Payment Aggregator Directions, 2025. Xtreme InfoSec is not CERT-In empanelled: we run the testing and help you fix the findings, and our CERT-In empanelled partner verifies them and issues the report. How CERT-In audits work →
No. PCI DSS 11.4 allows penetration tests by a qualified internal resource or a qualified external third party with organisational independence, and the tester does not need to be a QSA or ASV. Your QSA reviews the report during the assessment.
No. PCI DSS asks for quarterly external scans by an approved scanning vendor (ASV) and, separately, penetration tests at least once a year and after significant changes. We run the penetration tests; the quarterly ASV scans stay with your ASV.
RBI’s cyber directions for payment system operators ask for VA and PT at least once a year and before any critical service goes live, and the PA Directions ask for bi-annual VAPT reports. PCI DSS adds yearly pentests, segmentation tests every six months for service providers, and tests after significant changes.
We prefer sandbox or UAT, agree windows for any production testing, use test merchants and small amounts, and avoid destructive tests.
Practical guides from our security team on scope, process and cost.
What is tested in an API pentest, how it is run and what the report shows.
Read the guide →Web securityWhat a web app pentest covers and what a good report looks like.
Read the guide →VAPT basicsWhat VAPT covers and when regulators or clients require it.
Read the guide →Book a free scoping call. Share your products and PCI scope, and get a clear plan and a fixed quote.
+91 98183 63944