What is VAPT? VAPT stands for Vulnerability Assessment and Penetration Testing. In simple terms, VAPT is a two-part security test: the vulnerability assessment finds and lists the weaknesses in your application, API or network, and the penetration test then tries to exploit those weaknesses the way a real attacker would, to prove which ones actually matter.
If you are asking "what is VAPT" because a client, auditor or regulator has asked you for a VAPT report, this guide is for you. It covers who needs VAPT and when, the difference between VA and PT, the main types of testing, the step-by-step process, what a good report and "VAPT certificate" look like, and how to choose a provider without wasting a quarter.
Key takeaways
- VAPT full form: Vulnerability Assessment and Penetration Testing. VA is broad and largely tool-assisted; PT is deep, manual and proves real impact.
- You usually need VAPT before an enterprise client security review, an ISO 27001 audit, a regulatory inspection, a product launch or after a major release.
- Common types are web application, API, mobile app, network, cloud and wireless testing, done as black, grey or white box.
- A good VAPT report has an executive summary, scope, method, CVSS-rated findings with proof, and step-by-step fixes, followed by a retest.
- A "VAPT certificate" is normally an attestation letter issued after the retest. It is evidence of testing, not a legal certification.
What is VAPT in cyber security?
VAPT in cyber security is a structured way of testing a system from an attacker's point of view, so that you find and fix problems before someone else finds them. The "system" can be a web application, a set of APIs, an Android or iOS app, your office or data centre network, or your cloud accounts.
The two halves do different jobs. A vulnerability assessment casts a wide net: it uses scanners and checklists to identify missing patches, misconfigurations, outdated components and known weaknesses. A penetration test goes deep: a tester manually chains issues together, bypasses controls and shows exactly what an attacker could reach, such as another customer's data or an admin panel.
Who needs VAPT, and when?
Most companies do not commission VAPT out of curiosity. There is usually a trigger, and knowing yours helps you scope the test correctly.
- Enterprise client security reviews. If you are a SaaS or IT services company selling to banks, large enterprises or global customers, their vendor security questionnaire will often ask for a recent third-party penetration test report. Without one, deals stall.
- ISO/IEC 27001 certification and surveillance audits. ISO/IEC 27001:2022 Annex A control 8.8, "Management of technical vulnerabilities", expects you to identify and address technical vulnerabilities. Periodic VAPT is one of the most common ways organisations show auditors that this control is working.
- Regulated entities. Regulators such as RBI and SEBI expect regulated entities to run periodic VAPT, and some ask for testing by a CERT-In-empanelled auditor. Requirements differ by entity type and change over time, so check the circular that applies to you.
- Product and app launches. Testing before go-live is far cheaper than fixing a breach later, especially for fintech, health and apps handling personal data under the DPDP Act.
- After major releases or infrastructure changes. A new payment flow, a new API version, a cloud migration or a new office network can introduce fresh weaknesses that last year's report does not cover.
Difference between vulnerability assessment and penetration testing
The difference between vulnerability assessment and penetration testing is mainly depth and proof. The table below sums it up.
| Aspect | Vulnerability assessment (VA) | Penetration testing (PT) |
|---|---|---|
| Goal | Find and list as many known weaknesses as possible | Prove which weaknesses can be exploited and what impact they have |
| Approach | Broad, largely tool-assisted | Deep, manual, attacker mindset |
| Finds business logic flaws? | Rarely | Yes, this is where PT adds most value |
| False positives | Common unless manually verified | Low, as findings come with proof |
| Output | List of vulnerabilities with severity | Exploitation evidence, attack chains, business impact |
A VA on its own is useful for routine hygiene, but it cannot tell you whether a logged-in user can view another customer's invoices by changing an ID in the URL. That kind of broken access control is exactly what manual penetration testing is designed to catch.
Types of penetration testing
There are several types of penetration testing, grouped by what is tested and by how much information the tester is given.
By target
- Web application VAPT covers login, sessions, access control, input handling and business logic, usually mapped to the OWASP Top 10 and the OWASP Web Security Testing Guide (WSTG v4.2). See web application penetration testing.
- API VAPT tests REST, GraphQL and SOAP endpoints against risks like broken object level authorization (API1 in the OWASP API Security Top 10 2023). See API penetration testing.
- Mobile app VAPT covers Android and iOS apps, their local storage, network traffic and backend APIs, guided by OWASP MASVS and MASTG. See mobile app penetration testing.
- Network VAPT tests external (internet-facing) and internal infrastructure: open ports, exposed services, weak configurations and lateral movement. See network penetration testing.
- Cloud security testing reviews AWS, Azure or GCP configuration, identity and access policies, storage exposure and logging. See cloud security assessment.
- Wireless testing checks Wi-Fi encryption, guest network isolation and rogue access points, typically for offices and factories.
By approach: black, grey and white box
- Black box: the tester gets no credentials or internal information, like an outside attacker.
- Grey box: the tester gets user accounts for each role and some documentation. This is the most common choice because it balances realism with coverage.
- White box: the tester gets full access, including architecture and sometimes source code. Deepest coverage; often paired with source code review.
Not sure which type of VAPT your client or auditor is asking for? Share the requirement and your scope, and use the VAPT cost estimator to get an indicative figure before you speak to anyone.
The VAPT process, step by step
A professional VAPT process follows a predictable sequence. If a provider cannot explain these steps clearly, treat that as a warning sign.
- Scoping. Agree exactly what is in scope: URLs, API collections, app builds, IP ranges, cloud accounts, user roles and testing windows. Sign the authorisation and rules of engagement.
- Reconnaissance. The tester maps the attack surface: subdomains, endpoints, technologies, open ports, app permissions and third-party components.
- Vulnerability assessment. Automated and manual checks identify candidate weaknesses, such as outdated components, misconfigurations and missing security headers.
- Manual exploitation. The tester attempts to exploit findings safely, tests business logic, chains low-severity issues into higher-impact attacks and removes false positives. This is the step that separates real VAPT from a scan.
- Reporting with CVSS. Each confirmed issue is rated, commonly with CVSS v3.1 (v4.0 was published in 2023), and documented with evidence and fix steps.
- Fixing. Your developers or infrastructure team remediate the issues, ideally in order of severity, and ask the testers questions where needed.
- Retest. The tester verifies each fix and updates the report to show which issues are closed.
VAPT report sample: what a good report contains
People search for a "VAPT report sample" because the report is what the client or auditor actually reads. Here is the structure a good report follows, described section by section.
- Cover and document control: application or asset name, version tested, test dates, report version and confidentiality marking.
- Executive summary: a one-page, non-technical view of overall risk, counts of findings by severity and the most important issues in business language.
- Scope and limitations: exactly what was tested, what was excluded, which roles were used and any constraints during testing.
- Methodology: the approach (black, grey or white box) and standards followed, such as the OWASP WSTG, OWASP API Security Top 10 or OWASP MASVS.
- Findings summary table: every issue with ID, title, severity, CVSS score and status (open or fixed).
- Detailed findings: for each issue, the affected URL or component, description, step-by-step reproduction, screenshots or request/response evidence, business impact, OWASP or CWE mapping and clear remediation guidance.
- Retest results: the status of each finding after fixes, with evidence that closed issues are actually closed.
Quick quality check: every finding should be reproducible, and fixable, from the report alone.
What is a VAPT certificate?
A "VAPT certificate" is a term buyers often use, but there is no single official VAPT certificate in India that every client accepts. In practice, it usually means an attestation letter (sometimes called a security audit certificate or safe-to-host letter) issued by the testing firm after the retest.
A typical letter states the scope, test dates, standards followed, and that reported issues were fixed or accepted as of the retest. It is evidence that a test was carried out at a point in time. It is not a legal certification, a guarantee that the system cannot be breached, or a substitute for the full report.
Before you commission testing, check what your client, tender or regulator actually wants: the full report, an attestation letter, a letter from a CERT-In-empanelled auditor, or a specific format. Getting this right at the start saves a second round of testing.
VAPT audit: how often should you do it?
There is no universal rule, but these are sensible defaults:
- At least once a year for any internet-facing application, API or network, which is also what many client questionnaires and audits expect.
- After every major release or architecture change, such as a new module, payment integration, authentication change or cloud migration.
- Before launch of a new product or app.
- More frequently if a regulator, client contract or internal risk policy says so. Regulated entities should follow the frequency in their applicable circular.
Between full VAPT audits, regular vulnerability scans and code-level checks (see SAST vs DAST) help catch issues earlier.
VAPT testing cost and how to choose a provider
VAPT testing cost depends mainly on scope: the number of applications, user roles, API endpoints, app platforms, IP addresses and the depth of testing. For a fuller breakdown, read our guide on penetration testing cost, or get an indicative figure from the VAPT cost estimator.
When comparing providers, ask these questions:
- Are findings manually verified? A scanner-only report full of false positives will not satisfy a serious security reviewer.
- Can I see a sanitised sample report? Check it against the report structure above.
- Which standards do you follow? Look for OWASP, CVSS and clear methodology, not vague promises.
- Is a retest included? Fixes need verification, and the retest is what an attestation letter is normally based on.
- What do I get at the end? Full report, executive summary, attestation letter, and in which format.
- Do you meet my specific requirement? For example, if your regulator or client asks for a CERT-In-empanelled auditor, confirm this before you sign.
At Xtreme InfoSec, VAPT is manual and expert-led across web, API, mobile, network and cloud. Tools are used, but every finding is manually verified, every report is OWASP-mapped with step-by-step fixes, and a free retest is included after you fix the issues. Indicative starting prices are web app from ₹30,000, API from ₹15,000, mobile app from ₹30,000 and network from ₹15,000, with a fixed quote after scoping. Timelines depend on scope and are confirmed in the quote.
Frequently asked questions
What is the full form of VAPT?
VAPT full form is Vulnerability Assessment and Penetration Testing. The vulnerability assessment identifies weaknesses, and the penetration test attempts to exploit them to show real-world impact. Together they give both breadth and proof.
Is VAPT mandatory in India?
There is no single law that makes VAPT mandatory for every business. However, regulators such as RBI and SEBI expect regulated entities to run periodic VAPT, and many enterprise clients, tenders and ISO 27001 audits ask for it. Check the specific circular, contract or audit requirement that applies to you.
How long does a VAPT take?
It depends on scope: a single small web application takes far less time than several apps, APIs and a network together. A good provider confirms the timeline in the quote after scoping.
Does a VAPT certificate mean my application is secure?
No. A VAPT attestation letter confirms that testing was done on a defined scope at a point in time and that the reported issues were fixed or accepted at retest. New code, new features and new threats can introduce new weaknesses, which is why periodic testing matters.
What should I prepare before a VAPT?
Prepare a clear scope list, test accounts for each user role, a stable test or staging environment, API documentation or collections, and a technical contact.
Need a VAPT report your client or auditor will accept?
Xtreme InfoSec runs manual, expert-led VAPT for web apps, APIs, mobile apps, networks and cloud, with an OWASP-mapped report, step-by-step fixes and a free retest. Tell us your scope and get a fixed quote.
Prefer to talk first? Contact us at contact@xtremeinfosec.com or +91 98183 63944.