01
Recon
Understand the target. Map the perimeter. Enumerate services, subdomains, and exposed interfaces.
SanathJeason
Cybersecurity consultant · VAPT specialist
From reconnaissance to remediation, through every layer of the stack — and everything that's been compromised.
My experience: 12 years, 500+ engagements across six industries
The Journey
Engagements
Start
2012. First role at Wipro. Learning to think like an adversary.
500+ engagements · 100+ clients · 6 industries · 12 years
The Methodology
How I Work
mapping the attack surface before a single packet
02
Model
Identify adversaries, attack vectors, and business-critical assets. STRIDE + CVSS + MITRE ATT&CK.
03
Exploit
Controlled exploitation to demonstrate real impact. Web, API, network, cloud, AD, mobile.
04
Report
Executive and technical reports. Risk-ranked findings with reproduction steps and remediation guidance.
05
Remediate
Re-test every fix. Close every finding. Compliance-mapped. Audit-ready.
Industries Secured
BFSI
Banking & Insurance
End-to-end penetration testing and security consulting across six critical industries.
- BFSI
- Manufacturing
- Healthcare
- E-Commerce
- Government
- Education
Case Studies
Proof,
not promises.
National Bank Group
Full-scope VAPT ahead of an RBI regulatory audit.
A leading private-sector bank required comprehensive penetration testing across its entire digital estate — delivered in a compressed timeline with zero business disruption.
The challenge
Fourteen web portals, internal network infrastructure, Active Directory, and multi-cloud workloads, all before an immovable Reserve Bank of India inspection date.
Approach
- External perimeter and 14 web portals assessed end-to-end
- Internal network and AD forest enumerated and exploited in-scope
- Cloud workloads across AWS and Azure reviewed
- Risk-ranked deliverables for executive and technical audiences
The result
- 140 vulnerabilities remediated
- Zero critical findings at RBI audit
- PCI-DSS certification achieved
- Active Directory fully hardened
Regional Hospital Network
Security uplift across 38 hospitals before a national health-data audit.
A hospital group with 38 facilities and fragmented IT needed a full security audit covering legacy OT/SCADA systems, patient-data stores, and cloud workloads — all inside a six-week window.
The challenge
Fragmented IT across 38 sites, legacy SCADA/BMS systems, 220K+ sensitive patient records, and no unified security policy in place.
Approach
- Network segmentation audit across all 38 facilities
- Medical device and OT/BMS inventory with full risk mapping
- Active Directory hardening deployed organisation-wide
- Cloud workload VAPT and HIPAA control documentation
The result
- Full network re-segmentation delivered
- Zero breaches in the 12 months post-engagement
- AD hardened across the entire organisation
- HIPAA controls fully mapped and documented
Growth-Stage FinTech
End-to-end security for a ₹180M-daily-GMV payments platform.
A fast-scaling platform with four million users needed full security coverage before a Series B raise — 200+ undocumented API endpoints, three payment gateways, and a cloud config that had never been audited.
The challenge
Hyper-growth codebase with 200+ API endpoints, three payment gateways, iOS and Android apps, and no security gate in the CI/CD pipeline.
Approach
- Full API security assessment across 200+ endpoints
- Payment gateway and PCI-DSS SAQ-A review
- iOS and Android mobile VAPT
- Cloud configuration audit and CI/CD security-gate design
The result
- 23 critical and high vulnerabilities closed
- PCI-DSS SAQ-A compliance achieved
- Zero payment incidents in six months post-fix
- CI/CD security gates added to the pipeline
Off the clock
Sometimes I compete.
Capture. Conquer.
CTF competitions, photography, and music production. A different kind of adversarial thinking.
Get in touch
Whatshouldwesecure now?