What Is VAPT? Complete Guide for India (2026)

VAPT stands for Vulnerability Assessment and Penetration Testing. It is a two-part security test: a vulnerability assessment (VA) scans your applications, servers, and networks to list known weaknesses, and a penetration test (PT) has a human tester actively exploit those weaknesses to prove what a real attacker could do. Together they show you not only where you are exposed, but how badly.

If you run a website, mobile app, API, or cloud environment in India, VAPT is probably already on your to-do list. A customer questionnaire, an ISO 27001 or SOC 2 audit, a regulator, or a CERT-In requirement has likely asked for it. This guide explains what VAPT is, what it covers, how the process works, what you receive at the end, and how to pick a provider without paying for a scan in disguise.

What Does VAPT Mean?

VAPT is a combined term for two related activities that are often sold together:

Vulnerability Assessment (VA): a broad, mostly tool-driven sweep that identifies known weaknesses such as outdated software, missing patches, weak configurations, and exposed services. Think of it as taking inventory of the doors and windows that might be unlocked.
Penetration Testing (PT): a focused, manual exercise in which an experienced tester tries to break in by exploiting those weaknesses, chaining small flaws together, and probing the business logic that scanners cannot understand. This is the part that tells you whether someone could actually walk through the unlocked door and what they could carry out.

You will also see it written as "vulnerability assessment and penetration testing," "VA/PT," or simply "pentest." In practice, a good VAPT engagement uses automated tools for coverage and human testers for depth.

Vulnerability Assessment vs Penetration Testing

Aspect	Vulnerability Assessment	Penetration Testing
Goal	Find and list known weaknesses (breadth)	Exploit weaknesses to prove real impact (depth)
Method	Mostly automated scanning, with review	Manual, human-driven, creative
Output	Prioritised list of vulnerabilities	Proof-of-concept exploits, attack chains, business impact
Business logic flaws	Rarely found	A core focus
False positives	Higher unless validated	Low, since findings are demonstrated
Typical frequency	Continuous or quarterly	Annually and after major changes
Relative cost	Lower	Higher

Neither replaces the other. A vulnerability assessment gives you cheap, repeatable coverage. A penetration test tells you which of those findings matter and uncovers the serious flaws a scanner will never flag, such as one customer being able to read another customer's data by changing a number in a URL. The danger to watch for is a "pentest" that is really just a scanner export with a logo on it; the penetration testing cost guide explains how to spot one.

Types of VAPT

VAPT is scoped by what is being tested. The most common types are:

Web application VAPT

Tests websites and web portals for flaws such as broken access control, injection (SQL, command), authentication and session weaknesses, cross-site scripting, and insecure file handling. This is the most requested type, especially for SaaS products, fintech platforms, and e-commerce stores.

Mobile application VAPT

Covers Android and iOS apps: insecure local storage, weak or missing certificate pinning, hard-coded secrets, exposed components, and insecure communication with the backend. Android and iOS are usually scoped separately. For a technical example, see how SSL pinning is bypassed in Flutter apps during a mobile assessment.

API security testing

Modern apps are mostly APIs. Testing focuses on broken object-level authorisation, excessive data exposure, mass assignment, weak authentication, and missing rate limiting.

Network VAPT (internal and external)

External testing targets what an attacker can reach from the internet: open ports, exposed services, VPN and remote access. Internal testing assumes an attacker already has a foothold and looks at lateral movement, weak credentials, and segmentation gaps.

Cloud security assessment

Reviews AWS, Azure, or GCP configuration: over-permissive IAM roles, public storage buckets, missing logging, exposed management interfaces, and container or Kubernetes misconfigurations.

Source code review (SAST) and DAST

Static analysis reads the code itself to find flaws early; dynamic analysis tests the running application. Many teams combine both with a pentest for the strongest coverage.

Red teaming is related but different: it is a goal-driven simulation of a real adversary across people, process, and technology, rather than a scoped test of specific assets.

Black-Box, Grey-Box and White-Box Testing

Black-box: the tester starts with no inside knowledge, like an outside attacker. Realistic, but time is spent on discovery.
Grey-box: the tester gets limited information, typically user accounts across different roles. This is the most cost-effective model for most applications because most real risk sits behind a login.
White-box: the tester gets full access to architecture, documentation, and often source code. It gives the deepest coverage.

The VAPT Process, Step by Step

Scoping and rules of engagement. Agree which assets are in scope, the testing window, contacts, and what is off limits. Everything is documented and authorised in writing.
Reconnaissance and information gathering. Map the attack surface: domains, endpoints, technologies, exposed services, and public information.
Vulnerability assessment. Run automated scans and manual checks to build a list of candidate weaknesses.
Manual exploitation. Validate each candidate by actually exploiting it, test business logic, and chain smaller issues into larger ones. This removes false positives and reveals real impact.
Post-exploitation and impact analysis. Determine what an attacker could reach once inside: data, privileges, other systems.
Reporting. Document each finding with severity, evidence, business impact, and remediation steps.
Remediation support. Walk your developers through the findings so fixes are correct, not just cosmetic.
Retest. Verify that the fixes work and issues are actually closed.

Penetration testing without written authorisation is illegal in India and can fall under Sections 43 and 66 of the IT Act, 2000. Every legitimate engagement begins with a signed scope and permission, and ideally runs against a staging environment or with agreed safeguards for production.

Standards and Methodologies Behind a Good VAPT

A credible tester works from recognised frameworks rather than improvising. The ones you will most often see are:

OWASP Top 10 and the OWASP ASVS for web applications, and the OWASP API Security Top 10 for APIs.
OWASP MASVS and MASTG for mobile applications.
PTES (Penetration Testing Execution Standard), NIST SP 800-115, and OSSTMM for overall methodology.
CIS Benchmarks for hardening servers, cloud accounts, and containers.

Ask any provider which of these their methodology maps to. A vague answer is a warning sign.

What a VAPT Report Should Contain

The report is the deliverable you pay for, and it is what auditors and customers will ask to see. A good one includes:

An executive summary written for non-technical leadership.
The scope, methodology, and testing dates.
Every finding with a severity rating (commonly CVSS-based), affected asset, and risk explanation.
Proof-of-concept steps and evidence so your team can reproduce each issue.
Business impact in plain language, not just a CVE number.
Remediation guidance that developers can act on.
A retest section showing which findings are now closed.

What Is a VAPT Certificate?

Customers, partners, and tender documents often ask for a "VAPT certificate." There is no government-issued VAPT certificate. In practice it is a letter or summary issued by the testing provider confirming that a test was carried out on a defined scope and date, and, ideally, that critical and high findings were fixed and verified in a retest. Request it after the retest rather than before, otherwise it only proves you found problems, not that you resolved them. If you need the full detail, share the report itself under NDA.

When Do You Need VAPT?

Before launching a new application, major feature, or API.
At least once a year for any internet-facing or data-handling system.
After significant change: infrastructure migration, new integrations, or a large release.
For compliance: ISO 27001, SOC 2, and PCI DSS audits expect evidence of technical vulnerability testing, and many RBI- and SEBI-regulated entities must test periodically under their sector frameworks. CERT-In also expects regular audits; see our guide to CERT-In guidelines and the compliance checklist.
For customer due diligence: enterprise buyers increasingly ask for a recent test report during vendor onboarding.
After an incident, to confirm the entry point is closed and nothing similar remains.

VAPT vs Bug Bounty vs Red Teaming

VAPT is a time-boxed, scoped, paid engagement with a formal report. Best for compliance and a predictable baseline.
Bug bounty is continuous, crowd-sourced testing where you pay per valid finding. Best as an addition once basics are in place, not a replacement for a formal test.
Red teaming simulates a determined attacker across technology and people to test detection and response. Best for mature organisations.

How to Choose a VAPT Provider

Ask what percentage is manual testing. A genuine pentest is mostly human work.
Ask for a sample (redacted) report and check that it has proof-of-concept evidence and clear remediation advice.
Confirm a retest is included. It should not be a separate upsell.
Check methodology and credentials: mapping to OWASP and PTES, and recognised tester certifications such as OSCP or CEH.
Check empanelment where relevant. If your regulator or customer requires a CERT-In empanelled auditor, verify the provider on CERT-In's official list.
Insist on an NDA and a clear data-handling policy for anything the tester sees or stores.
Look for a walkthrough call, so your developers can ask questions about the findings.

On price, a manual web application VAPT in India typically starts around ₹40,000 and scales up with scope. See the detailed VAPT and penetration testing cost breakdown for India for ranges by test type.

Frequently Asked Questions About VAPT

What is the full form of VAPT?

VAPT stands for Vulnerability Assessment and Penetration Testing. It combines a largely automated scan that lists known weaknesses with a manual test in which a security professional exploits them to show real-world impact.

What is the difference between vulnerability assessment and penetration testing?

A vulnerability assessment is broad and mostly automated, and it produces a list of known weaknesses. A penetration test is manual and focused, and it exploits weaknesses, chains them together, and tests business logic to show what an attacker could actually do. A good VAPT combines both.

Is VAPT mandatory in India?

No single law requires every business to run VAPT, but it is effectively required in many situations. RBI- and SEBI-regulated entities have cyber security frameworks that call for periodic testing, CERT-In's audit guidelines expect regular comprehensive audits, ISO 27001, SOC 2, and PCI DSS audits look for evidence of technical vulnerability testing, and many enterprise customers ask for a recent report. Check the rules that apply to your sector.

How long does a VAPT take?

A single web or mobile application typically takes 3 to 7 business days of testing plus reporting. Larger scopes, such as several applications, internal networks, or compliance-driven engagements, usually run 2 to 3 weeks. The exact timeline is confirmed during scoping.

How often should VAPT be done?

At least once a year, and again after any major change such as a significant release, new integrations, or an infrastructure migration, since each can introduce attack surface the last test never covered.

What is a VAPT certificate?

A VAPT certificate is not a government-issued document. It is a letter or summary from the testing provider confirming that a test was carried out on a defined scope and date and, ideally, that critical and high findings were fixed and verified in a retest. Request it after the retest.

Next Steps

VAPT is most valuable when it is scoped properly, performed manually, and followed by a retest. If you want a clear scope and quote for your web application, mobile app, API, or infrastructure, get in touch and I will scope it with you before we talk numbers.