PHANASInformation to Intelligence.
Home / Services

Our services

From penetration testing to ISO 27001 certification and staff training, we help you understand your risks and reduce them.

Vulnerability Assessment & Penetration Testing

We identify security weaknesses in your applications and infrastructure and show how an attacker could exploit them. Every finding comes with clear evidence and practical guidance to fix it.

What we test

  • Web applications: login, access control, input handling and business logic
  • APIs: REST and GraphQL authorisation, tokens and rate limits
  • Networks: external perimeter, internal network and Active Directory
  • Cloud: AWS, Azure and GCP configuration and access

What you receive

  • Executive summary for management
  • Findings with CVSS risk ratings, evidence and steps to reproduce
  • Remediation guidance specific to your technology
  • Walkthrough session with your team

How a VAPT engagement runs

  1. Scope

    Agree targets, test windows, rules of engagement and contacts.

  2. Test

    Automated scanning followed by manual testing. Critical issues are reported immediately.

  3. Report

    Detailed report and a walkthrough with your technical team.

  4. Retest

    Once fixes are in place, we verify them and confirm closure.

Our testing follows OWASP, PTES and NIST SP 800-115 guidelines.

Enquire about VAPT

Red Teaming

A red team exercise simulates a real attacker working towards a defined goal. It shows how well your people, processes and security tools detect and respond to an attack.

How it works

  1. Planning: agree objectives and rules with a small group from your management.
  2. Reconnaissance: map your external footprint, people and technology.
  3. Attack simulation: gain access and move towards the objective while avoiding detection.
  4. Debrief: walk through the attack with your defenders.

What you receive

  • Attack narrative mapped to MITRE ATT&CK
  • Timeline of what was detected and when
  • Prioritised recommendations to improve detection and controls

Suitable for organisations that already test regularly and want to measure their detection and response.

Enquire about Red Teaming

Source Code Review

We review your application code to find security flaws that are difficult to detect from the outside, such as missing authorisation checks, hard-coded secrets and unsafe data handling.

What we review

  • Authentication and authorisation logic
  • Input validation and injection risks
  • Use of cryptography and secrets
  • File handling and deserialisation
  • Third-party libraries and dependencies
  • Logging of sensitive or personal data

We combine automated scanning with manual review. Each finding points to the exact file and line, with a suggested fix.

Enquire about Code Review

Tabletop Exercises

A facilitated session where your leadership and IT teams work through a realistic cyber incident. It tests your response plan and clarifies roles and decisions before a real incident happens.

Common scenarios

  • Ransomware attack
  • Customer data breach
  • Business email compromise and payment fraud
  • Insider or third-party compromise

What you receive

  • A scenario tailored to your business and systems
  • A facilitated session for management and technical teams
  • An after-action report with gaps, owners and recommendations

Sessions can be held at your office in Ahmedabad, Surat or elsewhere, or online.

Enquire about Tabletop Exercises

Security Awareness & Phishing Simulation

Many attacks begin with an employee clicking a link or sharing a code. We run ongoing awareness programmes that test employees with realistic simulations and help them learn from each mistake.

Programme includes

  • Phishing simulations by email, SMS, voice and WhatsApp
  • Instant guidance for employees who click
  • Role-based training for finance, HR and management
  • Regular reports for management

How we run it

  1. Baseline: an initial campaign to measure current awareness.
  2. Plan: a campaign calendar agreed with your HR and IT teams.
  3. Run: regular simulations with training for employees who click.
  4. Review: reports showing click and reporting rates over time.

Programmes are delivered on PhishNova, our phishing simulation platform, and managed by the PHANAS team.

Enquire about Awareness

Secure Development of Enterprise Solutions

We design and build enterprise applications with security included from the first day of the project. This reduces rework later and helps your software pass security reviews and audits.

What we build

  • Enterprise applications: portals, internal platforms and business systems
  • APIs and integrations between your systems
  • Cloud-native systems: microservices on containers and Kubernetes
  • DevSecOps pipelines with automated security checks

Security at every stage

  • Threat modelling during design
  • Secure coding standards and code review
  • Automated code and dependency scanning
  • Encryption, audit logs and role-based access
  • Penetration testing before go-live

We follow OWASP ASVS and secure development practices aligned with ISO 27001.

Discuss your project

ISO 27001 ISMS Implementation

We help you set up an Information Security Management System that meets ISO/IEC 27001:2022 and prepare you for the certification audit.

Implementation steps

  1. Gap assessment against the standard and its Annex A controls
  2. Scope and risk assessment, including the risk treatment plan
  3. Statement of Applicability
  4. Policies, procedures and controls
  5. Internal audit and management review
  6. Support during the Stage 1 and Stage 2 certification audits

The certificate is issued by an accredited certification body. We prepare you for the audit and support you through it.

Enquire about ISO 27001

Security Training

Practical courses taught by working security professionals. Our Web Security Course teaches you to protect businesses from hackers, malware and data breaches through hands-on practice.

Web Security Course topics

  • How the web works: HTTP, sessions and browsers
  • OWASP Top 10 vulnerabilities
  • Authentication, access control and injection
  • API security basics
  • Safe browsing and security hygiene
  • Hands-on lab practice and report writing

Who it is for

  • Students and professionals starting a career in cybersecurity
  • Developers and testers who want to build more secure applications
  • IT teams, through private batches tailored to your organisation

Contact us for upcoming batch dates, duration and fees.

Enquire about Training

Not sure where to start?

Call us or send an enquiry, and we will recommend the right first step.

Contact us +91 75738 98889