Pricing Contact Case Studies Research Talk to a Pentester ↗
PoCForge / About Us
ABOUT US

Offensive security for the way modern teams build

PoCForge is a human-led penetration testing practice. We help organisations find exploitable weaknesses across web, API, mobile, cloud, infrastructure and AI systems — then prove impact and retest fixes.

Request a free scope review →Explore solutions
Isometric workbench with a laptop, a printed report and an orange retest check badge, beside the heading "About PoCForge" and the PoCForge logo.
  • Human-ledSenior practitioners lead
  • Short pathsYou talk to the testers
  • ProofFindings you can reproduce
  • RetestIn-scope fixes checked again

Who we are

PoCForge is a boutique offensive-security practice. Engagements are led by senior practitioners, with specialist collaborators brought in when a scope needs deeper coverage. We keep communication paths short: your team talks to the people testing your systems — not a rotating ticket queue.

The practice is based in Delhi (NCR) and serves product and security teams worldwide — remote-first, with on-site in India when a scope needs it. Day-to-day contact: [email protected]. India-market commercial pages live at VAPT services in India and the VAPT India hub.

PRACTITIONERS

Who leads the testing

Engagements are led by senior offensive-security practitioners with around eight years in the field, based in Delhi NCR. You talk to the people doing the testing directly — not a rotating ticket queue.

For larger or specialised scopes, trusted specialists join under the same statement of work and confidentiality terms, and you are told who is on the engagement before testing begins. See the role-based overview on Team.

What we believe

  • Human-led offensive testing

    manual reasoning plus targeted automation.

  • Proof-of-exploit

    show what an attacker can actually do within agreed rules.

  • Remediation retest

    verify fixes instead of leaving closure ambiguous.

  • Business-logic focus

    authorisation, workflow abuse, tenant isolation and privilege boundaries — not only generic OWASP checklists.

  • Straight scoping advice

    we tell you when a lighter scan is enough, and when it is not.
More detail

India market notes

We work with SaaS, fintech and product teams internationally; a meaningful share of conversations are with India-based teams preparing for enterprise security reviews, customer questionnaires or SOC 2 / ISO-style evidence. We publish indicative INR pricing, plain-language buyer guides and a CERT-In decision page. We do not claim CERT-In empanelment or other credentials we cannot substantiate. If your procurement requires empanelment, verify the official CERT-In register and read Do you need CERT-In empanelled VAPT?.

Pricing is scoped to your attack surface and kept transparent — typically slightly under broad market package openers for comparable manual work, with clear caveats. See the 2026 cost guide.

Industries and surfaces

We most often work with software product companies — multi-tenant SaaS, API-first platforms, fintech and payments-adjacent products, and teams shipping Electron/desktop or AI-assisted features. Surfaces include web, API, mobile, cloud, external infrastructure, internal/AD, desktop/Electron and AI/LLM-integrated systems. Explore the map on Solutions or India pages via the VAPT India hub.

Quality bar

What we put our name to is manual testing and evidence you can reproduce: every finding is reproducible, impact-framed and prioritised for engineering, and every fix in scope is retested. Anonymised engagement shapes live on our case studies page. Technical depth and methodology notes appear in Research.

Certifications and empanelment

If your procurement requires CERT-In empanelment or a named accreditation, verify it on the issuing body’s official register. Empanelment status and testing quality are related but distinct questions.

Working with us

Most engagements begin with a short written scope outline: surfaces, environments, roles, timeline and constraints. We keep proposals short and specific. If you are comparing vendors, send the same RFQ to everyone — our India RFQ checklist is designed for that. For desktop/Electron products, see also desktop application pentesting India.

Based outside India? Delivery is remote, with the same scoping and reporting. See the pages for teams in the UAE, Singapore and the United States.

Explore further

Explore further