What is VAPT? VAPT stands for vulnerability assessment and penetration testing: two related security tests, usually bought together, that find weaknesses in your systems before an attacker does. The vulnerability assessment finds as many known weaknesses as possible. The penetration test shows which of them an attacker could actually use, and what they could reach. This guide explains both, what you should receive, what drives the price, and how often regulators in India and elsewhere require it.
Vulnerability assessment vs penetration testing
A vulnerability assessment is broad. Scanners and a tester check your systems against known weaknesses, such as missing patches, outdated software, weak configurations and exposed services, and list what they find with a severity rating. It answers the question: what is wrong?
A penetration test is deep. A tester behaves like an attacker, tries to exploit the weaknesses, chains small issues together and tests the logic of your application, such as whether one customer can see another customer's data. It answers a different question: what could someone actually do? Automated scanning alone cannot find most business-logic flaws, which is why the two are combined.
Types of VAPT
VAPT is scoped by target. The common types are:
- Web application testing, usually against the OWASP Top 10 and your own business logic.
- API testing, against the OWASP API Security Top 10, including authorisation between users and tenants.
- Mobile application testing, covering the app on the device and the APIs behind it.
- External network testing of everything reachable from the internet.
- Internal network testing, which assumes an attacker or a compromised laptop is already inside.
- Cloud configuration review of your AWS, Azure or Google Cloud accounts.
How a VAPT engagement runs
A proper engagement starts with scoping and written authorisation: what is in scope, what must stay out, which environment, test accounts at each privilege level, and testing windows. Testing without written permission from the system owner is not a pentest. Then come discovery, the vulnerability assessment, manual testing and exploitation, and the report. After you fix the findings, a retest confirms the fixes worked.
Testing can be black box (no inside knowledge), grey box (test accounts and some documentation) or white box (full access to code and architecture). Grey box is the usual choice because it finds more in the same number of days.
What the report should contain
The report is the product you are buying, so ask to see a sample before you sign. A useful report has an executive summary in plain language, findings ranked by real risk to your setup, reproduction steps your engineers can follow, specific remediation advice, and retest results. Our full sample VAPT report is published so you can judge it before you buy.
Common findings
Every environment is different, but the same kinds of issue come up again and again in web, API and network testing:
- Broken access control, such as one user reading or changing another user's records by changing an ID.
- Weak authentication and session handling, including missing MFA on admin accounts.
- Security misconfiguration, such as default settings, verbose errors and open cloud storage.
- Outdated components with known vulnerabilities.
- Admin panels, databases or remote access services exposed to the internet.
- Sensitive data in responses, logs or client-side code that should not be there.
How long it takes and what drives the cost
A typical assessment takes one to three weeks of testing, plus reporting and a retest. The price follows the effort, and these are what move it:
- How many applications, APIs, endpoints and user roles are in scope.
- How many IP addresses or cloud accounts are included.
- Authenticated testing, which finds far more and takes longer than testing from outside only.
- Whether a retest is included, and how many rounds.
- Deadlines and reporting standards set by a regulator, auditor or customer.
After the report: fixing and retesting
A report only has value if the findings get fixed. Start with the issues that are both serious and reachable, give each one an owner and a date, and fix the root cause rather than the single example the tester found: if one endpoint skips an authorisation check, others probably do too. Then ask for the retest. A retest report showing the issues are closed is often what an auditor, regulator or customer actually wants to see, so keep it with the original report as evidence.
How often regulators require VAPT
Most VAPT is bought because someone asked for it, and the rules differ:
- RBI (commercial banks, 2026 directions): vulnerability assessment at least every six months and penetration testing at least every 12 months for critical and customer-facing systems in the DMZ.
- SEBI CSCRF: at least once a year, twice a year for systems identified as critical by NCIIPC, and after major releases, by a CERT-In empanelled auditor.
- PCI DSS v4: external and internal penetration testing at least every 12 months and after significant changes (requirement 11.4).
- ISO 27001 and SOC 2: no fixed frequency, but you need evidence that you find and fix technical weaknesses, and a recent pentest is the usual evidence.
What CERT-In empanelment means
CERT-In, India's national cyber security agency, maintains a panel of information security auditing organisations. Government organisations commonly use the panel, and some regulators require it: SEBI's CSCRF, for example, requires VAPT by a CERT-In empanelled auditor. Where that applies, the report must come from an empanelled firm. VITI Security is not CERT-In empanelled; in those cases we prepare you for the empanelled firm and fix what it would find. Where no empanelment is required, our own report is the deliverable.
How to choose a VAPT provider
Ask every provider the same questions:
- Who exactly will test, and what is their experience?
- Can we see a full sample report?
- How much of the testing is manual, and how much is scanning?
- Is a retest included?
- How do you handle our data and any credentials we share?
- If our regulator requires CERT-In empanelment, are you empanelled?
Frequently asked questions
What is the difference between VA and PT?
Is an automated scan enough?
How often should we do VAPT?
Can VAPT break our production systems?
Is VITI Security CERT-In empanelled?
Get a fixed price for your VAPT
Tell us what is in scope and who is asking for the test. We will come back with a fixed price and a sample of the report you will get.