Key Findings (2026 from Cybersecify VAPT engagements):
- VAPT is the Indian compliance term combining Vulnerability Assessment (automated scanning) and Penetration Testing (manual testing for business logic and authentication flaws).
- A real VAPT engagement runs 7 to 14 calendar days per scope with manual testing. VAPT sold under INR 25,000 with 1 to 2 day turnaround is almost always scanner output relabeled, not a real engagement.
- Indian regulatory contexts where a VAPT report is expected: SOC 2 (US enterprise customers), ISO 27001 (Indian and international audits), CERT-In incident reporting, RBI guidelines for fintech.
VAPT stands for Vulnerability Assessment and Penetration Testing. It combines automated scanning to find known vulnerabilities (outdated libraries, misconfigurations, weak credentials) with manual penetration testing to find business logic flaws and authentication bypasses that scanners miss. The term is primarily used in India.
You’ve been asked for a “VAPT report.” Maybe a client put it in their vendor questionnaire. Maybe your compliance team flagged it. Maybe an investor asked during due diligence. You nodded and said “we’ll get that done,” and now you’re Googling what VAPT actually means.
Here’s the short version: VAPT stands for Vulnerability Assessment and Penetration Testing. It’s two distinct activities, usually bundled together, especially in India. This post breaks down what each part involves, what you actually get at the end, and how to avoid wasting money on the wrong engagement.
Vulnerability Assessment vs Penetration Testing
These are not the same thing. They get bundled under “VAPT” so often that people treat them as one activity, but they test different things in different ways.
Vulnerability Assessment (VA)
A vulnerability assessment is a broad, mostly automated scan of your systems. The goal is coverage: find as many known vulnerabilities as possible across your entire attack surface.
What happens: A security engineer configures a scanner (Nessus, Qualys, OpenVAS, or similar), runs it against your infrastructure or application, and reviews the output. The scanner checks for known CVEs, misconfigurations, default credentials, missing patches, and weak TLS settings.
What you get: A list of vulnerabilities ranked by severity (Critical, High, Medium, Low, Informational). Each finding includes a description, affected asset, and remediation guidance.
What it doesn’t do: A VA doesn’t prove exploitability. It tells you “this port is running an outdated version of Apache with a known vulnerability.” It doesn’t tell you whether an attacker can actually chain that with other weaknesses to steal data or gain access.
Penetration Testing (PT)
A penetration test is a manual, targeted exercise where a security tester tries to break into your system the way a real attacker would. The goal is depth: prove what damage is actually possible.
What happens: A tester (following methodologies like PTES or the OWASP Testing Guide) manually probes your application for logic flaws, authentication bypasses, privilege escalation paths, and data exposure issues. They chain findings together to demonstrate real attack scenarios.
What you get: A report with proof-of-concept exploits, attack narratives, screenshots, and business impact analysis. Not just “this is vulnerable” but “here’s how we used this to access your admin panel and export your customer database.”
What it doesn’t do: A pentest doesn’t give you a complete inventory of every low-severity issue. It’s focused on what matters, not on listing every missing header.
Side-by-Side Comparison
| Vulnerability Assessment | Penetration Testing | |
|---|---|---|
| Approach | Automated scanning + manual review | Manual testing + selective tooling |
| Goal | Find all known vulnerabilities | Prove real-world exploitability |
| Coverage | Broad (scans everything) | Deep (focuses on critical paths) |
| Finds | Known CVEs, misconfigs, missing patches | Logic flaws, auth bypasses, chained exploits |
| Output | Vulnerability list with severity ratings | Attack narratives with proof-of-concept |
| Effort | Hours to days | Days to weeks |
| Skill required | Mid-level engineer with scanner expertise | Senior tester with manual exploitation skills |
Why “VAPT” Is an Indian Thing
If you talk to security teams in the US or Europe, they say “pentest” or “vulnerability scan.” The bundled term “VAPT” is mostly used in India, driven by compliance requirements from RBI, SEBI, CERT-In, and IRDAI that specifically reference “VAPT” in their guidelines.
The practical effect: Indian companies often buy a single engagement labeled “VAPT” and assume they’re getting both. Sometimes they are. Sometimes they’re getting an automated scan with a cover page that says “VAPT Report.” The difference matters.
What a Good VAPT Report Contains
A report worth paying for includes:
- Executive Summary - Business-language overview for leadership. What’s the risk posture? What needs immediate attention?
- Scope and Methodology - What was tested, what wasn’t, which methodology was followed (OWASP, PTES, NIST SP 800-115)
- Findings with Evidence - Each vulnerability documented with: severity rating, affected component, steps to reproduce, screenshots or request/response pairs, and business impact
- Attack Narratives - How findings chain together into real attack scenarios (this is what separates a pentest from a scan)
- Remediation Guidance - Specific, actionable fixes. Not “improve input validation” but “add parameterized queries to the
/api/usersendpoint, line 42 ofuserController.js” - Retest Confirmation - After you fix the issues, the tester verifies the fixes work. If your vendor doesn’t include retesting, ask why.
Red flag: If your report is 200 pages of scanner output with a logo slapped on top, you paid for a VA and got sold a “VAPT.”
When Do You Need a VAPT?
You definitely need one if:
- A client or partner is asking for a pentest report as part of vendor onboarding
- You’re preparing for SOC 2 or ISO 27001 certification
- You’re processing payments and need PCI DSS compliance
- You’ve just shipped a major feature or rewritten a core module
- You’re handling sensitive data (health records, financial data, PII) and haven’t tested in 12+ months
- CERT-In, RBI, SEBI, or IRDAI guidelines apply to your business
You probably don’t need one yet if:
- You’re pre-product with no users and no production environment
- You already ran a pentest last quarter and haven’t shipped significant changes
A common cadence for growing startups: pentest once or twice a year, and run vulnerability scans quarterly or after major releases.
How to Choose a VAPT Vendor
Questions to ask before signing:
About the testing:
- Will testing be manual, automated, or both? What percentage is manual?
- Which methodology do you follow? (Look for OWASP, PTES, or NIST references)
- How many days of active testing are included?
- Does the engagement include retesting after remediation?
About the team:
- Who will actually do the testing? (Not the sales team, the testers)
- What certifications does the testing team hold? (OSCP, CREST, CEH, CompTIA PenTest+)
- Will the same person test and write the report?
About the output:
- Can I see a sample report?
- Will findings include proof-of-concept exploits or just scanner output?
- Do you provide remediation support or just the report?
Red flags:
- “We’ll run our proprietary scanner” (you’re buying a VA, not a VAPT)
- No named testers or certifications mentioned
- Turnaround under 3 days for a web application (not enough time for real manual testing)
- Report delivered as a PDF export from Nessus/Burp with no custom analysis
Typical VAPT Cost in India
Pricing varies based on scope (number of applications, APIs, infrastructure components), depth of testing, and vendor reputation. Here’s what the market looks like:
| Scope | Typical Range (INR) | What to Expect |
|---|---|---|
| Single web app (basic) | 50,000 - 1,50,000 | VA + limited manual testing |
| Single web app (thorough) | 1,50,000 - 3,00,000 | Full manual pentest + retesting |
| Web app + mobile app + API | 2,50,000 - 5,00,000 | Multi-scope engagement |
| Infrastructure (cloud/on-prem) | 1,00,000 - 4,00,000 | Depends on number of IPs/hosts |
Beware of vendors offering “full VAPT” for under 20,000. At that price, you’re getting an automated scan and a templated report. That has its place, but don’t confuse it with a penetration test.
Where to Start
If you know your scope and want to get moving:
-
Startup Pentest (INR 74,999) - 1 application scope, 7 days of testing, founder-led engagement. Good for a single web app or API that needs a proper manual pentest before a client audit or compliance milestone.
-
Growth Pentest (INR 1,79,999) - 2 scopes (e.g., web app + API, or web app + mobile app), 10 days of testing. Includes SOC 2 + ISO 27001 audit prep and is built for startups heading into enterprise sales.
Both plans include free retesting after remediation.
Not sure what you need? Book a free 30-min discovery call with the founders. We assess your current security posture and recommend the right scope. No payment, no commitment.
The Bottom Line
VAPT is two things: an automated scan for breadth and a manual test for depth. You need both, but you need to know which one you’re actually buying. Ask your vendor hard questions about methodology, manual effort, and report quality. A good VAPT doesn’t just hand you a list of CVEs. It shows you what an attacker can actually do with your system and tells you exactly how to fix it. See our web application pentest service page, API pentest service page, or AI application pentest service page for scope, methodology, and inclusions.