Data & Cloud
Threat models, penetration tests and audit-ready evidence
Brihat Infotech reviews how your system could be attacked, tests it, fixes what the tests find, and writes the documents your buyers and auditors ask for. Each assessment has a fixed fee, and the retest is included.
What the assessment covers
- Architecture review
a threat model that lists who could attack which part, and how.
- Application testing
static code analysis (SAST), a dependency audit and a manual penetration test.
- Identity and access
single sign-on, least-privilege roles and secrets kept out of source code.
- Compliance preparation
preparation for ISO/IEC 27001 and control mapping to the questionnaires your buyers send.
- Keys and encryption
where keys live, who can use them and what is encrypted.
- Incident readiness
a written plan with severity levels and a named escalation path.
- Supply-chain review
a software bill of materials (SBOM) that lists every component you ship.
What each test looks at
Static analysis reads your source code for patterns that are known to cause flaws. The dependency audit lists every library you use and flags the ones with published vulnerabilities. The manual penetration test then tries real attacks on the running system, which finds what automated tools miss.
Rules we follow on your systems
- Access is limited to what each person needs, per environment, and removed when a phase ends.
- Production data never gets copied to a developer's machine.
- Data is encrypted in transit with TLS 1.2 or later.
- Your cloud accounts stay under your own billing.
- No client data is used to train models.
Your data under Indian law
Where you hold personal data, you get a written DPDP position. It covers consent, the purpose each field is kept for, the retention period, and erasure on request. If you hold personal data at large volume, begin with a scoped assessment.
How an assessment runs
- 01Scoping meeting, on site or in Noida. We agree which systems and which threats are in scope.
- 02Threat model and tests. One security architect and one penetration tester take the scope between them.
- 03Findings report. Each finding has a severity and a fix.
- 04Retest. After your team fixes the findings, we test them again. This is part of the fixed fee.
An assessment typically takes 4 to 12 weeks. Brihat itself holds ISO/IEC 27001 (information security) and ISO 9001 (quality). How we engage shows where security testing sits in a build.
Documents you receive
- The threat model
- The penetration test report, with the retest result
- Your DPDP position
- A buyer posture pack for procurement teams
Where this was applied
IRFC, investor platform for Section 54EC bonds. Investors had no direct view of their holdings. We built the sign-up and identity checks for investors, one screen that adds up all their bonds, and the design of the system underneath, for a public-sector corporation. See the IRFC Invest case study
Also see: software for government and PSUs
Tell us which buyer's security questionnaire is waiting on you.
Tell us what you want to build.
The first call is 45 minutes with an architect, usually the founder. It is free, and we will sign an NDA first if you ask.