Offensive security · Digital forensics
Find the breach before someone else does.
GladiatorRX tests your web apps, APIs, mobile apps and networks the way a real attacker would. Your team gets a clear report it can act on, and we retest every fix.
Certified testers: OSCP & CEH · Startup India registered
Invoice API returns other companies' invoices
Validate tenant ownership on every request, and use non-sequential identifiers.
- OSCP
- CEH
- Startup India
- OWASP
- PTES
- NIST
- ISO 27001
- PCI DSS
Services
Six ways we test what you've built
Every engagement is scoped to your systems, carried out by hand, and mapped to the standards your auditors and customers already ask for.
Penetration testing
Hands-on security testing of your web applications, networks and cloud by certified testers.
PTES · OWASP WSTG · NIST SP 800-115 Learn moreVulnerability assessment
A broad, verified sweep of your infrastructure for known weaknesses and missing patches.
CVSS 3.1 / 4.0 · NIST SP 800-115 Learn moreAPI security testing
In-depth testing of REST, GraphQL and gRPC APIs, covering access control, authentication and business logic.
OWASP API Security Top 10 Learn moreMobile security testing
Android and iOS app testing, including the backend APIs each app depends on.
OWASP MASVS · MASTG Learn moreOSINT investigations
What attackers can learn about your organisation and people from public sources, powered by our own platform.
Powered by GladiatorRX OSINT Learn moreDigital forensics
Evidence collection, analysis and incident investigation when something has already gone wrong.
NIST SP 800-86 · ISO/IEC 27037 Learn moreWhy GladiatorRX
The diagnosis comes with a prescription
The name says it. Gladiator, because we test like an opponent. Rx, because every finding comes with a fix.
Tested by people, not just tools
OSCP and CEH certified testers do the work themselves. Scanners help, but they can't find the logic flaws that lead to real breaches.
A fix for every finding
Each issue comes with a specific fix your developers can apply, not a generic "follow best practice".
Free retest
Once you've fixed the issues, we verify every one and issue an updated report and attestation letter.
Reports that pass review
Scope, methodology, severity and evidence, in the format ISO 27001, SOC 2 and PCI DSS auditors expect.
What you receive
A report your board and your developers can both use
Leadership gets a one-page summary of risk. Engineers get exact reproduction steps, evidence and fixes. Auditors get scope and methodology.
- Executive summary in plain language
- Findings rated by severity and business impact
- Evidence and a recommended fix for every issue
- Retest results and an attestation letter
How we work
From scoping call to closed findings
Scope
A 30-minute call to agree on targets, testing windows and rules of engagement. You get a fixed quote.
Map
We map what's in scope: features, user roles, integrations, and anything exposed that wasn't on the list.
Test
Hands-on testing by certified testers. Critical issues are reported to you straight away.
Report
A summary for leadership, plus a detailed finding for each issue with evidence and a specific fix.
Retest
We verify your fixes and issue an updated report and attestation letter.
Industries
Built around how your sector gets attacked
Fintech, banking & NBFCs
Payment flows, lending platforms and customer data under RBI and PCI DSS expectations.
- RBI
- PCI DSS
- SEBI CSCRF
SaaS & B2B software
Multi-tenant isolation, APIs and the security reports enterprise buyers ask for before signing.
- SOC 2
- ISO 27001
E-commerce & D2C
Checkout, coupons, refunds and the logic abuse that turns into direct revenue loss.
- PCI DSS
- DPDP Act
Healthtech
Patient records, telemedicine apps and integrations with labs, insurers and hospitals.
- DPDP Act
- ISO 27001
Edtech
Large user bases, minors' data, payment flows and exam integrity.
- DPDP Act
Startups
Security testing sized for early-stage teams, with reports ready for investors and enterprise customers.
- Due diligence
- SOC 2 readiness
Our platform
GladiatorRX OSINT
The investigation platform our own analysts use every day, now available to your team. Search, connect and report on open-source intelligence from one workspace.
How do we get a quote?
Fill in the contact form or call us. We'll set up a 30-minute scoping call, then send a fixed quote, usually within two business days.
What affects the price?
Mainly scope: the number of applications, user roles, API endpoints, IP addresses or devices, and whether you need a retest or ongoing coverage. We quote a fixed price, so there are no surprise hourly bills.
Do you sign NDAs?
Yes. We're happy to sign your NDA, or we can provide ours, before you share any details.
Do you work with small companies and startups?
Yes. We're a registered startup ourselves, and we size engagements to match early-stage budgets and timelines.
Who does the testing?
Our in-house testers, who hold industry certifications including OSCP and CEH. We don't subcontract your engagement.
What if you find something critical?
We tell you straight away, not at the end of the engagement, so you can start fixing it immediately.
Find out where you're exposed before an attacker does.
Tell us what you need tested. We'll reply within one business day with questions or a fixed quote.