VAPT stands for Vulnerability Assessment and Penetration Testing. It is a structured security test of your website, web application, APIs, mobile app, servers or network, carried out by people who think like attackers but report to you instead of exploiting you. This guide answers the two questions business owners ask us most often: what is VAPT, and why do businesses need it when they already have a firewall, antivirus and a developer who looks after security?
Below we cover the difference between VA and PT, the types of VAPT, how a test runs, which Indian regulations and contracts expect it, how to read the report, cost and choosing a provider. If you already know you need a test, our VAPT services page explains scope and pricing.
What Is VAPT and Why Do Businesses Need It?
A vulnerability assessment (VA) finds and lists known weaknesses: outdated software, missing patches, weak TLS settings, exposed admin panels, default passwords and common misconfigurations. A penetration test (PT) goes further. A tester tries to exploit those weaknesses, and others no scanner can see, to show what an attacker could actually reach: customer records, invoices, admin functions or the server itself.
Together, VAPT gives you a prioritised list of real, verified problems and clear instructions to fix them. It is not a certificate that you are secure. It is an honest snapshot of what a skilled attacker could do to the systems in scope, on the dates they were tested.
Businesses need it for practical reasons:
- Attackers do not wait for you to grow. Automated tools scan the internet every day for vulnerable plugins, exposed databases and weak logins. A small company with a customer portal is found the same way a large one is.
- Firewalls and antivirus do not fix application flaws. If a logged-in user can change an ID in the URL and see another customer's invoice, no firewall will notice. That is a flaw in your application logic, and only testing finds it.
- Customers and regulators ask for proof. Enterprise clients, banks, insurers and auditors increasingly want a recent VAPT report before they sign or renew.
- Fixing early is far cheaper. A flaw found in testing becomes a developer ticket. The same flaw found by an attacker becomes data recovery, customer notices, legal advice and lost trust.
Vulnerability Assessment vs Penetration Testing
The two halves are usually sold together, but they answer different questions. A vulnerability assessment asks what weaknesses exist. A penetration test asks what someone can actually do with them.
| Aspect | Vulnerability assessment | Penetration testing |
|---|---|---|
| Main goal | Find and list known weaknesses across many systems | Prove real impact by exploiting weaknesses |
| Method | Mostly automated scanning, with manual verification | Mostly manual work by a skilled tester, supported by tools |
| Depth | Wide but shallow | Narrower but deep, including business logic |
| Finds logic flaws, such as one customer seeing another's data | Rarely | Yes, and this is where most of the value lies |
| False positives | Common unless each item is verified | Low, because each finding is demonstrated |
| Output | List of issues with severity ratings | Verified findings with proof of concept and attack path |
| Typical frequency | Monthly or quarterly for internet-facing systems | Annually and after major changes |
A scan-only "VAPT" is the most common way businesses pay for less than they think: a long scanner export with no proof of concept is a vulnerability assessment, not a penetration test. A scan-led vulnerability assessment is still useful for wide coverage between full tests.
Types of VAPT
VAPT is scoped by target. Most businesses need one or two of these, not all of them.
- Web application VAPT: customer portals, admin panels, e-commerce stores and SaaS products. It tests login and session handling, access control, input handling, payment flows and business logic against the OWASP Top 10 and the deeper checks in OWASP ASVS. See web application VAPT.
- API security testing: the REST or GraphQL APIs behind your mobile app, front end and partner integrations. APIs often return more data than the screen shows, and broken object-level authorisation is one of the most common serious findings. See API security testing.
- Mobile app VAPT: Android and iOS apps, covering local storage, hard-coded keys and the APIs the app calls.
- Network VAPT: your internet-facing IPs, firewalls and VPNs, and internally, how far an attacker could move from one compromised office laptop.
- Cloud configuration review: AWS, Azure or Google Cloud accounts, looking for public storage buckets, over-permissive roles and exposed databases.
- Source code review: reading the code for security flaws, most useful for high-risk modules such as login and payments.
Black Box, Grey Box and White Box Testing
These terms describe how much the tester knows before starting.
- Black box: the tester gets only a URL or IP range, like an outside attacker. It is realistic for the public view, but much of the time goes into discovery, and areas behind the login may never be reached.
- Grey box: the tester gets test accounts for each user role and basic documentation such as an API collection. This is the best value for most business applications, because the serious flaws usually sit behind the login: one role doing what another should not, or one customer reaching another customer's data.
- White box: the tester also gets source code, architecture diagrams and sometimes configuration access. It is the most thorough option and suits fintech, health data and other high-risk systems, but it takes longer.
If you are unsure, ask for grey box testing with one test account per role. For a typical portal or SaaS product it finds the most real issues for the money.
The VAPT Process, Step by Step
A well-run engagement follows a predictable sequence. At EthicsComputer it runs like this:
- NDA and scoping. We sign an NDA before any technical discussion, then agree exactly what is in scope: URLs, APIs, user roles, IPs and environments, and anything that must not be touched.
- Rules of engagement. Testing window, production or staging, our source IPs, emergency contacts, and what happens if a critical issue is found mid-test. Critical issues are reported straight away, not held back for the final report.
- Reconnaissance and scanning. Mapping subdomains, exposed services, API endpoints and user flows, and running scanners for known vulnerabilities so manual time goes where it matters.
- Manual testing. The core of the work: login and session handling, access control between roles and customers, business logic such as prices, coupons and approval flows, file uploads, injection flaws and API behaviour. Our testing is manual-first and aligned with OWASP Top 10, OWASP ASVS and CERT-In guidelines.
- Careful exploitation. Each finding is proven with a safe proof of concept. Destructive actions, denial of service and bulk data extraction are avoided unless explicitly agreed.
- Reporting and fix support. Each finding gets a CVSS-rated severity, the affected asset, steps to reproduce, evidence, business impact and remediation guidance written for developers, who can ask us questions while they fix.
- Re-test. Once fixes are deployed, the findings are tested again and the report is updated with their status. One re-test is included free.
Who Needs VAPT in India
Any business with a login page, customer data or online payments benefits from VAPT. For some, it is effectively required. Here is where the expectation comes from.
Banks, NBFCs, payment companies, brokers and insurers
Entities regulated by the RBI, SEBI and IRDAI work under cyber security frameworks issued by their regulator. These expect regular vulnerability assessment and penetration testing of critical and internet-facing systems, timely closure of findings, and in many cases testing by qualified, independent auditors. Frequency and auditor requirements differ by regulator and type of entity, so check the current circular that applies to you. If you are a technology vendor to such an entity, expect these requirements to appear in your contract.
CERT-In guidelines and directions
CERT-In, India's national agency for cyber security incidents, publishes guidance on security auditing and maintains a list of empanelled IT security auditing organisations. Government bodies and some regulated sectors require audits by an empanelled auditor. CERT-In's 2022 directions also require organisations to report specified cyber incidents within six hours of noticing them and to keep system logs for 180 days.
ISO 27001 certified companies
ISO/IEC 27001:2022 Annex A control 8.8, management of technical vulnerabilities, expects you to identify technical vulnerabilities, evaluate your exposure and act on them. A VAPT report with a completed re-test is some of the clearest evidence an auditor can see.
Every business that handles personal data
Section 8(5) of the Digital Personal Data Protection Act, 2023 requires every data fiduciary to protect personal data by taking reasonable security safeguards to prevent a personal data breach, and the DPDP Rules, 2025 describe what those safeguards include. The Act's penalty schedule for failing this duty goes up to ₹250 crore. Regular testing is how you show the safeguards actually work. Our guide to DPDP Act compliance and security audits covers this in detail.
Vendors answering security questionnaires
Larger customers send vendor security questionnaires that ask whether an independent third party has penetration tested your product, and when. A recent report summary with critical and high findings closed often decides whether a deal moves forward or stalls in procurement.
How Often Should You Do VAPT?
- At least once a year for every internet-facing application and server.
- Before launch of a new application, customer portal or mobile app.
- After major changes: a new payment flow, new user roles, a move to a new host or cloud, a framework upgrade or a large release.
- Monthly or quarterly automated scans between full tests, to catch newly published vulnerabilities in the components you use.
- As your regulator or client requires, which may be more often than the above.
How to Read a VAPT Report
A good report is written for two readers: management, who need to understand the risk, and developers, who need to fix it.
- Executive summary: scope, dates, overall risk and the few issues that matter most, in plain language.
- Severity ratings: most reports use CVSS scores. A score of 9.0 to 10.0 is Critical, 7.0 to 8.9 High, 4.0 to 6.9 Medium and 0.1 to 3.9 Low. Fix Critical and High first, but read the business impact too. A Medium issue on your payment page may matter more than a High one on a forgotten test server.
- Each finding: the affected URL or asset, a description, steps to reproduce, evidence such as screenshots or request and response, the impact and a specific fix.
- Re-test status: open, fixed or partly fixed, recorded after your developers deploy changes.
Signs of a weak report: no proof of concept, generic advice copied from a scanner such as "update to the latest version", dozens of informational items padding the page count, and no findings at all about access control on an application that clearly has several user roles.
What Drives VAPT Cost
Price follows effort, and effort follows scope. The main drivers are the number of applications, user roles and workflows; the number of API endpoints and whether they are documented; IP addresses for network testing; mobile apps; black, grey or white box testing, with or without code review; and any report format a regulator or client requires.
The ranges below are indicative, based on typical quotes in the Indian market. They are not survey data, and your scope decides the real number.
| Scope | Typical market range (indicative) |
|---|---|
| Single business website or small web application | ₹20,000 – ₹75,000 |
| Web application with several user roles and APIs | ₹75,000 – ₹3,00,000 |
| Mobile app with its APIs | ₹50,000 – ₹2,00,000 |
| Network VAPT | Usually priced per IP address or network segment |
EthicsComputer's VAPT and company security audit starts at ₹25,000 + 18% GST, covering one website or web application plus a core server check. The final quote follows a short scoping call.
How to Choose a VAPT Provider
- Ask for a sample report, redacted. It shows exactly what you will receive.
- Ask how much of the testing is manual, and who will do it.
- Check the methodology: OWASP Top 10 and ASVS for applications, the OWASP API Security Top 10 for APIs, and alignment with CERT-In guidelines.
- Confirm an NDA before scoping, and ask how your findings are stored and deleted afterwards.
- Check that a re-test is included, and how long after the report you can use it.
- Look at their own security practices. An ISO/IEC 27001 certification shows the provider runs its own information security management system. EthicsComputer is certified to ISO 9001:2015, ISO 20000:2018 and ISO/IEC 27001:2022.
- If your regulator or client requires a CERT-In empanelled auditor, confirm that requirement before you sign and check the provider against CERT-In's published list.
- Be wary of guarantees. No honest provider promises that you will be fully secure. Testing reduces risk; it does not remove it.
FAQs
What is the difference between VA and PT?
A vulnerability assessment finds and lists known weaknesses, mostly through automated scanning with manual verification. A penetration test goes further: a tester manually exploits weaknesses, including business-logic flaws that scanners cannot see, to prove what an attacker could actually reach. VAPT combines both.
Is VAPT mandatory for businesses in India?
No single law makes VAPT mandatory for every business. It is effectively required for entities regulated by the RBI, SEBI and IRDAI under their cyber security frameworks, and it is expected for ISO 27001 certification and in many enterprise vendor contracts. The DPDP Act 2023 also requires reasonable security safeguards for personal data, and regular testing is the practical way to show they work.
How long does a VAPT take?
For one website or a small web application, testing and reporting usually take about one to two weeks. Larger applications with many user roles, APIs and mobile apps take longer. Fixing time depends on your developers, and the re-test follows once the fixes are deployed.
Will VAPT disrupt our live website?
A properly run test is planned to avoid disruption. Testing windows are agreed in advance, destructive tests and denial-of-service are excluded unless you ask for them, and critical issues are reported immediately. For high-risk systems, testing a staging copy that mirrors production is a good option.
How much does VAPT cost in India?
It depends on scope: the number of applications, user roles, APIs, IP addresses and mobile apps. As an indicative market range, testing a single business website or small web application often costs ₹20,000 to ₹75,000. EthicsComputer's VAPT starts at ₹25,000 plus 18% GST for one website or web application plus a core server check, with the final quote after scoping.
If you want to know what an attacker could reach in your website, portal or app, start with a scoped test. Explore our VAPT and penetration testing services for scope and pricing, or contact us to sign an NDA and book a short scoping call. You can also WhatsApp us on +91 90532 10052.
