Penetration testing and VAPT in Sri Lanka
Ghost Protocol is a penetration testing company in Colombo that tests one web application and its API at a fixed, published price, with the report in 5 to 7 days, a free re-test and a signed attestation letter. Ryan Sebastian, the founder, leads every test and signs the letter, and every finding is reproduced by hand before it reaches the report.
Not sure you need a test yet? Start with the free website scan: 10 categories of checks on your public surface, in about a minute, with no signup.
Last reviewed
Two things you can check before you talk to us
What we found when we read the websites of Sri Lanka’s listed companies, and the standard of the report you would receive.
Colombo Stock Exchange listed company websites, September 2026
99 of 151 homepages (65.6%)
sent no Content-Security-Policy header, which limits the scripts a page may run.
73 of 151 homepages (48.3%)
sent no HSTS header, which tells browsers to always use the secure version of the site.
43 of 151 homepages (28.5%)
showed software version numbers in their response headers.
A passive check of 151 websites that returned a normal homepage. Signs of configuration habits, not proof that any site can be broken into, and no company is named. The census: figures, method and limits
Three findings from our example report
| Severity | CVSS | Finding |
|---|---|---|
| Critical | 9.8 | GP-NWR-01: Mass assignment on customer registration grants the administrator role (API3:2023) |
| High | 8.1 | GP-NWR-02: Broken object-level authorisation on order read and update (API1:2023) |
| Medium | 6.5 | GP-NWR-04: No rate limiting or lockout on authentication and password reset (API4:2023) |
The example report (GP-EXAMPLE-2026-001) is written against a client that does not exist; the findings are real vulnerability classes. The report, page by page
What you receive
Six things, all inside the fixed price. None of them is sold separately.
Executive report
Every finding rated and explained in plain English, with the decisions to make first. Page one is for the board; the finding pages are for your engineers.
Signed attestation letter
Who tested what, when, by which method, and the outcome. The document you give auditors, customers and investors.
Reproduction steps
Every high-severity finding comes with step-by-step proof your engineers can replay in staging.
Developer findings in JSON and SARIF
The same findings in machine-readable form, for GitHub Advanced Security, SonarQube or your CI pipeline.
A free re-test
Once you have fixed the findings, we test them again and reissue the report and the letter.
30 days of questions
Email the engineer who ran your test with follow-up questions for 30 days after delivery.
What is tested, and what is not
The scope of our fixed-price test, the same on every page that describes it.
In scope
- Your public web application
- Its REST or GraphQL API
- Up to three hostnames, tested grey-box with logins for two user roles
- Login, sessions and password reset
- Business-logic abuse: price tampering, one customer reading another's records, a user acting above their role
- The OWASP Top 10 and the OWASP API Security Top 10 (2023)
- TLS, DNS and certificate configuration
- Payment webhook handling, where you have it
The API part, entry by entry: API penetration testing. An AI agent or MCP server inside the application: AI agent security testing.
Not included
- Mobile apps (iOS and Android)
- Internal corporate networks, including the internal and segmentation testing PCI DSS also asks for
- Social engineering and phishing of your staff, and red-team exercises
- Denial-of-service testing
- Third-party services you do not control, such as your payment processor or identity provider
- Physical security
Social engineering and red-team engagements are offered as separate engagements, scoped and quoted individually. The fixed-price web and API penetration test does not include them. A larger scope, with more applications, hostnames or roles, is quoted. How every test runs, from rules of engagement to its limits, is in our published method.
How it runs, day 0 to day 30
Nothing is tested without written authorisation from the owner of the system. The testing is one week; the three weeks after it are yours, to fix and have the fixes checked.
- Day 0
- A 15-minute call. We confirm the scope and sign the engagement letter, and you send the target details and written authorisation.
- Day 1
- Our scanning engine sweeps the scope while the engineer watches. It takes a few hours.
- Days 1 to 5
- The engineer checks every finding by hand, removes false positives, and tests what scanners cannot see: business logic, and attacks that chain several steps.
- Days 5 to 7
- The report, the attestation letter and the JSON and SARIF findings, with a 30-minute call through every high-severity finding.
- Days 7 to 30
- Once you have fixed the findings, we test them again and reissue the report at no charge.
What Sri Lankan rules and audit frameworks ask for
No Sri Lankan statute requires every company to run a penetration test. The report and the signed letter support the duties below; they do not make you compliant on their own.
| Rule or framework | What it asks | What the test gives you |
|---|---|---|
| Personal Data Protection ActAct No. 9 of 2022 | Security measures suited to the risk to the personal data you process. The Act does not name penetration testing. | Evidence toward that duty, with the re-test record showing your fixes held. A test does not make you compliant on its own. |
| Sri Lanka CERT|CCWeb Application Security Guidelines (2022) | Recommends periodic security assessments, at least annually, and published these guidelines for government organisations. | If your application serves or connects to a government body, the published bar it is measured against. |
| Central Bank of Sri LankaBanking Act Directions No. 16 of 2021, 5.8.3 | Licensed banks must have critical information systems penetration-tested by independent external experts at least annually, and other systems exposed to customer data, and repositories of customer data, at least once every two years, including those held by their agents and third-party service providers. Since the 2023 amendment, banks incorporated outside Sri Lanka may use their head office's or branches' test teams. | Evidence toward that duty for one application: external, application-layer, grey box with two roles. One part of the duty, not the whole of it. |
| ISO/IEC 27001:2022A.8.8 | ISO 27001:2022 does not mandate a penetration test, but control A.8.8 expects technical vulnerabilities to be found, evaluated and acted on. | The report, the re-test record and the letter are the evidence auditors sample. ISO 27001 penetration testing |
| SOC 2CC4.1 | SOC 2 does not explicitly require a penetration test. Auditors commonly file one as evidence that your controls are evaluated. | The report and the signed letter, for the auditor and for customers’ questionnaires. SOC 2 penetration testing |
| PCI DSS11.4.3 · 11.4.4 | External and internal penetration testing under requirement 11.4, with findings corrected and re-tested. | The external application-layer test (11.4.3) and the loop of fixing and re-testing (11.4.4). Internal and segmentation testing are not included. |
The CBSL line is read from the Direction as issued on 9 December 2021 and its amendment, Banking Act Directions No. 05 of 2023 (8 December 2023). Not sure which of these reach your company? The security obligations checker maps four answers to the Sri Lankan instruments that apply, each cited. For the long version, read our VAPT buyer’s guide for Sri Lanka.
Price, invoicing and payment in LKR
Invoiced by Ghost Protocol (Private) Limited, company number PV00305227.
- Penetration test for a company registered in Sri Lanka: one web app and its API, up to three hostnames and two user roles
- LKR 1,200,000
- The same test for international clients
- $4,000
- Optional: delivery in 72 hours
- +LKR 90,000
Companies registered in Sri Lanka are invoiced in LKR at the local rate card: Security Scan LKR 40,000, Penetration Test LKR 1,200,000 (expedite +90,000), Security Retainer LKR 150,000 a month, Regulated engagements from LKR 2,400,000. Bank transfer, Net 14, exclusive of applicable taxes. It is a separate price for the local market, not a conversion, and it is reviewed twice a year.
Questions Sri Lankan buyers ask
How much does a penetration test cost in Sri Lanka?
For companies registered in Sri Lanka, our web and API penetration test is a fixed LKR 1,200,000, invoiced in LKR, paid by bank transfer, Net 14, exclusive of applicable taxes. International clients pay a fixed $4,000. Delivery in 72 hours is LKR 90,000 extra ($500 for international clients). There is no hourly billing.
What is VAPT, and is it different from a penetration test?
VAPT means vulnerability assessment and penetration testing. The assessment is the broad sweep that lists possible weaknesses; the penetration test is the human work that proves which of them an attacker could actually use. Our fixed-price engagement is both: our scanning engine sweeps first, then the engineer verifies, exploits and chains what it found, and tests what it cannot see.
Does the PDPA require a penetration test?
No. The Personal Data Protection Act No. 9 of 2022 asks for security measures suited to the risk and does not name penetration testing. A test, with the re-test record showing your fixes were verified, is evidence toward that duty. It does not make you compliant on its own.
Do licensed banks need an external penetration test?
Yes. Banking Act Directions No. 16 of 2021 (Schedule I, 5.8.3) require licensed banks to have critical information systems penetration-tested by independent external experts at least annually, and other systems exposed to customer data, and repositories of customer data, at least once every two years, including those held by their agents and third-party service providers. Under Banking Act Directions No. 05 of 2023, banks incorporated outside Sri Lanka may use penetration test teams from their head office or branches instead. Our fixed-price test covers one application's external, application-layer part of that duty. The rest is a larger scope, quoted.
Will the report be accepted for SOC 2, ISO 27001 or PCI DSS?
It is written for auditors, but acceptance is your auditor's decision. SOC 2 does not explicitly require a penetration test; auditors commonly file one as evidence under CC4.1. ISO 27001:2022 does not mandate one; control A.8.8 is where auditors file it. For PCI DSS the test covers the external application-layer part of requirement 11.4 only: 11.4.3 and the 11.4.4 re-test. Internal and segmentation testing are not included.
How long does a penetration test take?
The report arrives 5 to 7 days after kickoff. Delivery in 72 hours is LKR 90,000 extra ($500 for international clients). The re-test of your fixes is free, up to day 30.
Who does the testing?
Ryan Sebastian, our founder, leads every engagement: he scopes it, runs the manual testing, writes the report and signs the attestation letter. Our scanning engine runs the automated sweep underneath, and every finding is verified by hand before it reaches the report.
Do you test mobile apps or internal networks?
Not in the fixed-price test, which covers one web application and its API. Mobile apps, internal corporate networks (including the internal and segmentation testing PCI DSS asks for), denial of service and physical security are not included. Social engineering and red-team engagements are offered as separate engagements, scoped and quoted individually. The fixed-price web and API penetration test does not include them.
Can we meet in person in Colombo?
Yes. Most engagements run fully remote, but for Colombo clients an in-person kickoff or report walkthrough is available on request.
What do we need to give you before the test starts?
Written authorisation from the owner of the application; the scope, meaning the application, its API and up to three hostnames; one test account for each of two user roles, with a note of what each may reach; your choice of production or staging; and a named contact we can reach within the hour.
Talk to the engineer who will test it
Email ryan@ghosts.lk or message +94 71 055 5055 on WhatsApp. Ryan replies within 24 hours. Working hours are Monday to Friday, 09:00 to 18:00 Colombo time (UTC+5:30).
Book a pentestRun the free scan Book a 15-minute call Buying for a company? Procurement details