Get started
Get ready for your next IRDAI cycle.
Book a free scoping call. Share your portals, apps and audit dates, and get a clear plan and a fixed quote.
+91 98183 63944IRDAI’s 2026 Information and Cyber Security Guidelines ask insurers and intermediaries to test internet-facing systems every six months and close high-risk gaps within 30 days. We test your portals, apps and partner APIs the way an attacker would, help your team fix every finding, and arrange the CERT-In empanelled audit report through our partner.
Share a few details and get clear next steps, a timeline and a fixed quote.
Insurance attacks target data: another customer’s policy, a claim file with medical records, or a partner API that returns more than it should. We test quote, buy, renewal and claims journeys by hand, alongside infrastructure checks, and map every finding to what IRDAI’s guidelines and your assurance auditor will ask for.
| SCANNER ONLY | XTREME INFOSEC | |
|---|---|---|
| Known vulnerability scan | ✓ | ✓ |
| Policy & claim data access (IDOR) testing | ✕ | ✓ |
| Partner & aggregator API testing | Limited | ✓ |
| Grey/white-box testing of internet-facing assets | ✕ | ✓ |
| Findings mapped to IRDAI guidelines | Limited | ✓ |
or call +91 98183 63944
Pick an area to see what we check — and a typical finding.
Quote, buy, renewal and claims journeys.
Aggregator, TPA, hospital and payment integrations.
Customer and agent apps on Android and iOS.
Portals for agents, POSPs, brokers and bancassurance partners.
Internet-facing servers, internal network and cloud.
Reports that fit the IRDAI assurance cycle.
Share your portals, apps, APIs and IRDAI audit dates. We sign an NDA first.
We list every internet-facing asset, partner API and critical internal system in scope.
Grey-box and white-box testing of apps, APIs and infrastructure in agreed windows.
Every finding with its risk and exact fix, with high-risk items flagged for 30-day closure.
We retest every fix; where a CERT-In empanelled report is needed, our partner verifies and issues it.
Tell us your entity type and IRDAI audit dates, and we’ll send a fixed quote.
Portals, apps and APIs exposed to the internet.
Internet-facing assets plus critical internal systems.
Testing that follows the IRDAI calendar.
Want a quick ballpark for the testing first? See typical VAPT prices →
“Their penetration testing methodology was thorough and aligned with OWASP standards. The final report was detailed, actionable, and easy for our developers to understand.”
“Xtreme InfoSec identified critical vulnerabilities that other vendors missed, with excellent remediation support.”
Under the IRDAI Information and Cyber Security Guidelines, 2026, internet-facing assets need a vulnerability assessment and grey/white-box penetration test at least every six months, critical internal applications and infrastructure at least once a year, and apps and APIs before they go live.
Yes. The guidelines cover insurers and most intermediaries, including brokers, corporate agents, web aggregators, TPAs, insurance marketing firms and ISNPs. Individual agents and POSPs are excluded, but insurers must hold them to a minimum security standard.
Yes, through our CERT-In empanelled partner. Xtreme InfoSec is not CERT-In empanelled: we run the testing and help you fix the findings, and the partner’s team verifies them and issues the report. How CERT-In audits work →
The 2026 guidelines say high-risk VAPT gaps should be closed within 30 days at most and then retested, and all audit gaps within two months. We prioritise findings so your team can meet those dates.
URLs and app builds, test accounts for each role, API documentation, a list of partner integrations and your audit dates. We sign an NDA first.
Practical guides from our security team on scope, process and cost.
What VAPT covers and when regulators or clients require it.
Read the guide →Web securityWhat a web app pentest covers and what a good report looks like.
Read the guide →API securityWhat is tested in an API pentest, how it is run and what the report shows.
Read the guide →Book a free scoping call. Share your portals, apps and audit dates, and get a clear plan and a fixed quote.
+91 98183 63944