How to choose a VAPT company in India: 10 questions to ask

A customer has asked for a VAPT report, or your auditor has. You search, you get five quotes, and they all say "comprehensive", "manual and automated" and "OWASP Top 10". The difference only shows when the report arrives, and by then you have paid.

These ten questions make the difference visible before you pay. You do not need to be technical to ask them. Ask for the answers in writing.

1. How many testing days am I paying for?

Price follows days. A single web app usually needs four to six days of testing; a SaaS product with an API and several user types needs eight to twelve. If a quote does not say how many days, you cannot compare it with anything.

2. How much of the work is done by hand?

Scanners are fast and cheap. They find old software and missing settings. They do not notice when one customer can see another customer's data, which is the problem that hurts SaaS companies most. Ask what share of the days is manual testing with real logins.

3. Which of our user types will you test?

Admins, managers, staff, customers: each one sees a different version of your app. A good test logs in as each one and tries to reach what it should not. If the quote does not name them, the tester may only test the login page.

4. Will you check that one customer cannot see another's data?

If many companies use your product, this is the question your enterprise customers care about most. The test should use two separate customer accounts and try to cross between them.

5. Is a retest included, and when?

Your customer wants to see that problems were fixed, not just found. A retest checks the fixes and updates the report. Ask if it is included, and how long you have to use it.

6. Can I see a sample report?

The report is what you are buying. It should have a one-page summary your customer can read, a list of what was and was not tested, and clear fixes for your developers. If a company will not show a sample, that tells you something. Ours is here, no form needed.

7. Who will actually do the testing?

Ask for the name of the person who will lead the test and who will review the report before it reaches you. You are trusting them with access to your product.

8. What do you need from us before you start?

A good company asks for test accounts for every user type, a stable test environment and a contact for urgent findings. If they ask for nothing, they are probably planning to scan from the outside.

9. What happens if you find something serious during the test?

You should hear about it straight away, not three weeks later in the report. Ask who will call you and how.

10. Do we need a CERT-In empanelled company?

Only if a regulator or a contract says so. Some RBI, SEBI and government rules require it; most customer security reviews, SOC 2 audits and ISO 27001 audits do not. If you do need one, choose an empanelled company for that audit. ZenoPentest does not claim CERT-In empanelment.

A quick way to compare quotes

Put each quote in a table with five columns: testing days, manual share, user types tested, retest included, sample report seen. The cheapest quote is often the one with the fewest days, and fewer days is not cheaper per problem found.

What this looks like with us

We publish our prices: a focused test of one app or API starts at ₹79,000 plus GST, and a full SaaS product and its API at ₹1,49,000. Both include a retest. See VAPT for Indian software companies or what VAPT costs in India.