VAPT cost in India: real prices, and what moves them
A manual web application VAPT in India costs about ₹75,000 to ₹3 lakh plus GST in 2026. Scan-led tests start near ₹40,000. ZenoPentest starts at ₹79,000 plus GST for one application or API, with a retest included.
In short
- Expect ₹75,000 to ₹3 lakh for a manual web application VAPT; under ₹50,000 is usually mostly scanning.
- Price follows testing days. Roles, tenants, API size and integrations decide the days.
- Compare quotes on testing days, manual coverage, retest terms and the report, not the headline number.
Price ranges in India, 2026
Published Indian prices we checked in October 2026 fall into three bands.
| Type of test | Typical price (plus GST) | What you usually get |
|---|---|---|
| Scan-led VAPT | ₹40,000 – ₹60,000 | Automated scan, light manual checks, report |
| Manual web application VAPT | ₹75,000 – ₹1.5 lakh | 4–6 testing days, one app, one retest |
| Product and API VAPT | ₹1.8 lakh – ₹3 lakh+ | 8–12 testing days, roles, tenants, API |
| Annual programme | ₹3 lakh – ₹6.5 lakh a year | Two or more tests through the year |
ZenoPentest prices
| Package | From (plus GST) | Testing days |
|---|---|---|
| Focused test | ₹79,000 | 4–6 |
| Product test | ₹1,49,000 | 8–12 |
| Release programme | ₹2,99,000 a year | Two tests |
Every package is manual and authenticated, and includes one retest round and a report written for your customer’s reviewer.
What drives the cost
| Driver | Why it adds days |
|---|---|
| Roles | Each role is tested against every other role. Five roles means far more pairs than two. |
| Tenants | Multi-tenant products need every object checked across a tenant boundary. |
| API size | Endpoints the app never calls, old versions and webhooks all need testing. |
| Integrations | SSO, SCIM, payments and callbacks each add their own flows. |
| Environments | A second environment or strict access controls add set-up time. |
| Reporting needs | Extra report versions, letters or readouts for several audiences take time. |
Page count, domain count and lines of code are poor predictors. A ten-page app with five roles and two tenants takes longer than a hundred-page brochure site.
How to compare two VAPT quotes
Ask each provider:
- How many testing days, and how many are manual?
- Which roles and tenants will be tested, with which accounts?
- Is the API tested beyond what the app calls?
- How many retests are included, and in what window?
- Can we see a sample report?
- Who does the testing, and who reviews the report before it is issued?
A cheaper quote with half the testing days is not cheaper per finding.
Our prices
Starting prices for the three packages. Your quote is fixed after a scoping call.
Compare packagesFocused test
One website, app or API. Right for a launch or a first customer review.
Product test
A full SaaS product, where each customer must only see their own data.
Release programme
Two tests a year, for teams that ship often and answer security reviews all year.
Questions buyers ask
How much does VAPT cost in India?
About ₹75,000 to ₹3 lakh for a manual web application VAPT in 2026. A larger multi-tenant product with APIs and SSO can cost more. ZenoPentest starts at ₹79,000 for one application or API and ₹1,49,000 for a product and its API.
Why are some VAPT quotes under ₹50,000?
Usually because most of the work is automated scanning, with little manual testing behind the login. That can be enough for a basic check, but it rarely finds broken access control or business-logic flaws, which cause most serious SaaS data exposures.
Does the price include a retest?
Every ZenoPentest package includes one retest round: within 60 days for a focused test and 90 days for a product test. Check this in every quote you compare; some providers charge for retests separately.
How is VAPT priced: per application, per day or per year?
Most providers price per application or per testing day. Annual programmes cover repeat tests through the year. ZenoPentest sells a focused test, a product test and an annual release programme from ₹2,99,000 a year.
How can I lower the cost of a VAPT?
Have test accounts for every role ready on day one, freeze the test environment, give the tester your API documentation, and exclude what does not need testing. Set-up delays are paid testing days that find nothing.
Get a fixed quote in rupees.
Tell us the application, the roles and the deadline. You get scoping questions, then a fixed quote.