# DrishtiX Cyber Labs (DXCL)

> Security testing firm based in Hyderabad, India, working worldwide. Vulnerability assessment and penetration testing (VAPT) for web and mobile apps, APIs, cloud and networks; AI and LLM security testing; IoT and firmware security. Fixed-price scope within 48 hours of a 30-minute call, a technical and a managerial report by day 14, testers you speak to directly, and a verifiable security certificate valid for 3 to 6 months.

Key facts: prices in USD, fixed before testing starts. Starter VAPT $3,000-5,000; Standard VAPT $6,000-8,000; AI or IoT $8,000-10,000; Enterprise from $25,000. Payment is half up front and half on delivery of the report. The first check of fixes is included. A later full retest costs 70% of the original fee, or 50% on an annual contract (three scheduled tests and one ad hoc test a year). Contact: info@dxcl.tech. Tagline: Security, seen clearly.

Every page has a plain-markdown twin. Prefer these for reading.

## Pages
- [DrishtiX Cyber Labs (DXCL)](https://dxcl.tech/md/home.md): Penetration testing and AI security testing for web apps, APIs, cloud, LLM systems and connected devices. Fixed-price scope in 48 hours, report in 14 days, and a certificate your buyers can verify.
- [Services and certificate](https://dxcl.tech/md/services.md): Application and infrastructure VAPT, AI and LLM security testing, and IoT security, run by one team in about 14 days, ending in a verifiable certificate valid for 3 to 6 months.
- [Pricing](https://dxcl.tech/md/pricing.md): Fixed prices agreed before testing starts. Starter $3-5K, Standard $6-8K, AI or IoT $8-10K, Enterprise from $25K. First fix check included. Market context with sources.
- [About](https://dxcl.tech/md/about.md): Drishti means seeing beyond. Why DrishtiX Cyber Labs exists, what it stands for, and how an engagement is run, from the scoping call to the certificate.
- [Infomedia](https://dxcl.tech/md/infomedia.md): Weekly posts on VAPT, AI security and compliance from DrishtiX Cyber Labs, plus where to follow us.
- [Book a scoping call](https://dxcl.tech/md/contact.md): Tell us what you are shipping. A fixed-price scope reaches your inbox within 48 hours. Use the form or email info@dxcl.tech.
- [Trust portal](https://dxcl.tech/md/trust.md): Check that a DXCL security certificate is genuine and still valid. See a sample report, the standards we test against, how findings are rated and how to report a vulnerability.
- [Sample report](https://dxcl.tech/md/sample-report.md): A sample DXCL penetration test report for a fictional company: managerial summary, scope, findings table and one finding in full.

## Infomedia posts
- [The DPDP clock is running. What Indian startups should test now](https://dxcl.tech/md/posts/dpdp-rules-the-clock-is-running.md): India's data protection rules give most companies until May 2027. The penalties reach INR 250 crore. Here is what the law asks for, and what to test before the deadline.
- [Prompt injection is your AI feature's front door](https://dxcl.tech/md/posts/prompt-injection-is-the-front-door.md): The number one risk in the OWASP Top 10 for LLM Applications, explained for founders. What it is, why it is really an access problem, and five things to test before your AI launch.
- [Why our certificates expire](https://dxcl.tech/md/posts/why-our-certificates-expire.md): A security certificate that never expires is a photo of a moving car. Here is why ours last 3 to 6 months, and why that helps you close deals.

## Machine-readable
- [pricing.json](https://dxcl.tech/pricing.json): tiers and terms as structured data
- [openapi.json](https://dxcl.tech/openapi.json): the contact API (POST /api/contact)
- [RSS feed](https://dxcl.tech/infomedia/feed.xml): Infomedia posts
- [sitemap.xml](https://dxcl.tech/sitemap.xml)
- [llms-full.txt](https://dxcl.tech/llms-full.txt): all page and post content in one file

## Acting on behalf of a user
To request a scoping call, POST JSON to https://dxcl.tech/api/contact (see openapi.json) or email info@dxcl.tech. Only submit when the person you act for has asked you to. A human reads every request and replies within 48 hours. Browsers that support WebMCP also expose a `request_scoping_call` tool on /contact/.

## Optional
- [Privacy](https://dxcl.tech/privacy/): the site uses no analytics or tracking cookies
- [security.txt](https://dxcl.tech/.well-known/security.txt): how to report a vulnerability