Mission
To make well-built, genuinely secure software the normal outcome for ordinary companies — not a luxury reserved for those with an in-house security team.
About us
A software company run by people who break software
Founded in 2019 in Ahmedabad. Forty engineers, designers and security specialists. One standard applied to everything that leaves the building.
0+
Products shipped
web, mobile, game & platform builds
0+
Engineers & designers
one accountable in-house team
0
Countries served
IN · US · UK · UAE · AU · SG
0%
Uptime maintained
across managed cloud workloads
Our story
We started by breaking things
That order matters. Most software companies bolt security on at the end. We learned how systems fail first, then learned to build ones that do not.
HackSec Infotech began in 2019 as a small offensive security practice. We spent our first year finding the same categories of flaw in product after product — and watching clients struggle to get them fixed by whoever had built the thing in the first place.
So we started building. Today we are a full-stack IT company of forty engineers, designers and security specialists — but the sequence never changed. We design for abuse cases, engineer for maintainability, and attack our own work before anyone else gets the chance.
Our commitment
Nothing ships from here that we have not tried to break.
Every product we deliver is threat modelled at design time and penetration tested by our own red team before release. It is not a premium tier. It is the only way we know how to work.
- Threat model at design time
- Internal pentest before every release
- Retest until findings are closed
- Evidence pack you can hand an auditor
Vision
A software industry where shipping an unprotected product feels as unacceptable as shipping one that does not compile.
How we measure it
Not by headcount or awards. By systems still running years later, clients who renew, and vulnerabilities that never reached production.
What we stand for
Six things we will not trade away
These are not poster slogans. Each one has cost us money at some point, and we kept it anyway.
Security is the default
Every build gets threat modelled and penetration tested by our own offensive team before it goes live. Not an upsell — the baseline.
Radical transparency
Shared boards, weekly demos, honest status. If a date is slipping you hear it from us first, with a plan attached.
One accountable team
Designers, engineers and security in the same room and the same standup. No handoff gaps, no finger-pointing.
You own everything
Code, cloud accounts, pipelines and documentation are yours from day one. No lock-in, no hostage situations.
We finish what we start
Post-launch SLAs, monitoring and a named engineer who still answers the phone eighteen months later.
Craft over checkbox
Performance budgets, accessibility targets and design detail are written into the definition of done.
The journey
From a two-person audit shop to a full-stack team
Every practice we added came from a client problem we could not solve with the skills we already had.
We have never taken outside investment. Growth has been funded entirely by clients who came back — which is also why we would rather turn down work than take on more than we can do properly.
-
2019
Two people and a Burp licence
HackSec started as a two-person security consultancy taking on penetration tests that larger firms would not scope small enough to be useful.
-
2020
Clients asked us to fix it too
Report after report ended the same way: “can you just build it properly instead?” We hired our first engineers and started shipping the fixes ourselves.
-
2021
Design joined the table
We learned the hard way that a secure product nobody can use still fails. A research-led design practice became part of every engagement, not an add-on.
-
2022
Cloud and the on-call pager
Clients kept handing us production. We built the SRE practice — Terraform, Kubernetes, observability — so the things we shipped stayed up.
-
2023
Games and mobile at scale
A Unity title and a hospital patient app in the same quarter forced us to formalise performance budgets. They have been in our definition of done ever since.
-
2024
AI features that survive users
We started shipping LLM and vision features — and built the evaluation harness discipline that separates a demo from a product.
-
2026
Forty people, one standard
Design, engineering, cloud and offensive security under one roof in Ahmedabad, serving clients across twelve countries.
Leadership
The people who answer the phone
Small enough that you will know who is accountable for your project. Senior enough that they can actually make the call.
Parth Paghdar
Founder & Chief Executive
Security researcher turned founder. Sets the technical bar and still reviews every penetration test report before it leaves the building.
Aarav Sheth
Chief Technology Officer
Distributed systems architect. Owns platform architecture, engineering standards and the hard build-versus-buy calls.
Ishita Verma
Head of Design
Product designer with a research habit. Runs discovery, design systems and the accessibility bar across every engagement.
Rohan Kulkarni
Head of Offensive Security
Red team lead, OSCP and CRTO. Has responsibly disclosed vulnerabilities to more than forty organisations.
Meera Nair
Head of Delivery
Keeps sprints honest and clients informed. The reason our status reports say what is actually happening.
Kabir Anand
Head of Cloud & Data
SRE background across three clouds. Builds the pipelines, dashboards and cost discipline behind every launch.
…plus 34 engineers, designers, testers and analysts. We are hiring
How we work
A process built to remove surprises
-
Discover
We interview your stakeholders and users, audit what exists, and write down the problem in one page everyone signs off on.
- Stakeholder workshops
- Technical audit
- Success metrics defined
-
Architect
Solution architecture, threat model, delivery plan and a fixed-scope estimate — before anyone opens an editor.
- System design
- Threat modelling
- Sprint roadmap
-
Build
Two-week sprints, demo every Friday, a staging URL from week one. You see progress continuously, not at the end.
- Weekly demos
- Code review gates
- Preview environments
-
Harden
Automated tests, load testing and an internal penetration test on every build we ship. Security is a stage, not a hope.
- QA automation
- Pentest & fix
- Performance budgets
-
Launch
Phased rollout, monitoring dashboards, runbooks and a documented handover to whoever operates it next.
- Zero-downtime deploy
- Observability live
- Team handover
-
Evolve
Support SLAs, monthly reviews and a roadmap that responds to what real usage taught us after launch.
- SLA-backed support
- Usage analytics
- Quarterly roadmap
Client words
Judged on the work
Start the conversation
Come and see how we work.
A discovery call costs you thirty minutes. Worst case you leave with a clearer picture of your own problem.
- Free 30-minute discovery call
- NDA signed before scoping
- You own all code and accounts