What is VAPT? Vulnerability assessment and penetration testing, explained
VAPT is two security tests done together. A vulnerability assessment finds known weaknesses across your systems, mostly with scanners. A penetration test then attacks the weaknesses that matter, by hand, to prove what an attacker could actually reach.
In short
- VA is breadth: automated scanning for known flaws. PT is depth: manual attacks that prove impact.
- A scan-only report is not a penetration test. Ask how much of the work is manual.
- Most buyers test web applications and APIs; network, cloud and mobile are separate scopes.
- Test at least once a year and after any significant change, such as a new role model, SSO or a payments flow.
- In India, a manual web application VAPT usually costs ₹75,000 to ₹3 lakh, depending on roles, tenants and API size.
VA and PT, side by side
| Vulnerability assessment (VA) | Penetration testing (PT) | |
|---|---|---|
| Question it answers | What known weaknesses exist? | What could an attacker actually do? |
| Method | Mostly automated scanning | Mostly manual testing |
| Coverage | Broad: many hosts and pages | Deep: the paths that matter |
| Finds well | Missing patches, misconfigurations, known CVEs | Broken access control, business logic, chained attacks |
| Misses | Logic flaws, authorisation bugs | Low-value issues outside the agreed scope |
| Output | A list of weaknesses by severity | Proven findings with evidence and fixes |
VAPT combines both, so the scan gives coverage and the manual work gives proof. The balance matters. A report that is 95% scanner output is a vulnerability assessment with a different name.
Types of VAPT
- Web application VAPT: logins, sessions, roles, tenant isolation, business logic and input handling. See web application VAPT.
- API VAPT: every endpoint, including the ones the app never calls, against the OWASP API Security Top 10. See API VAPT.
- Network VAPT: internal and external hosts, services and segmentation.
- Cloud VAPT: configuration of AWS, Azure or Google Cloud accounts, identity and storage.
- Mobile VAPT: the app on the device and the API behind it.
ZenoPentest tests web applications, APIs and AI features. Network, cloud configuration and mobile device testing are separate work we do not sell today.
Black, grey and white box
- Black box: the tester gets nothing but the URL. Realistic for an outside attacker, slow for everything behind the login.
- Grey box: the tester gets working accounts for each role. Most coverage per testing day, and what most SaaS buyers need.
- White box: the tester also gets source code or architecture documents. Best for complex authorisation logic.
How a VAPT runs
- Scope: applications, APIs, roles, tenants, environments and exclusions, written down.
- Authorisation: the system owner signs before any testing starts.
- Discovery and scanning: map the application and run automated checks.
- Manual testing: test every role against every other role and tenant; test the workflows.
- Reporting: each finding with the request, the response, the impact and a specific fix.
- Readout: walk your engineers through the findings.
- Retest: check the fixes and issue an updated report.
What a good VAPT report contains
- A summary a customer’s reviewer can read in minutes: scope, dates, method, results.
- A coverage record: what was tested, what was not, and why.
- Each finding with severity, affected roles, evidence and a fix.
- A retest record showing which findings are fixed, and when that was checked.
Read a complete sample VAPT report to see each part.
Standards behind the method
Credible VAPT follows public methods: the OWASP Web Security Testing Guide, OWASP ASVS, the OWASP API Security Top 10 (2023) and NIST SP 800-115. Ask any provider which they use and how they record coverage against it.
What VAPT costs
Price follows testing days, and testing days follow how much of the application an attacker could reach: roles, tenants, API size and integrations. See VAPT cost in India for real figures and what moves them.
Questions buyers ask
What is the full form of VAPT?
Vulnerability Assessment and Penetration Testing. The assessment finds weaknesses; the penetration test exploits the important ones to show their real impact.
What is the difference between VA and PT?
A vulnerability assessment is broad and mostly automated: it lists known weaknesses such as missing patches and misconfigurations. A penetration test is narrow and manual: a tester chains weaknesses together, the way an attacker would, and proves what data or actions they lead to.
Which tools are used for VAPT?
Common tools include Burp Suite and OWASP ZAP for web applications and APIs, Nmap for network discovery, and Nessus or OpenVAS for vulnerability scanning. Tools find candidates. The findings that matter most in web applications, such as broken access control and business-logic flaws, are found by hand.
How much does VAPT cost in India?
A manual web application VAPT in India usually costs ₹75,000 to ₹3 lakh, plus GST. Scan-led tests can be cheaper. ZenoPentest starts at ₹79,000 plus GST for one application or API, with one retest included.
How long does VAPT take?
Testing for one web application or API usually takes 4 to 6 days; a multi-tenant product and its API takes 8 to 12. Add a few days for scoping before and reporting after, plus the time your team needs to fix findings before the retest.
How often should we do VAPT?
At least once a year, and after any significant change to the application. PCI DSS requires penetration testing at least every 12 months and after significant change, and many customer security reviews ask for a test from the last 12 months.
What is the difference between VAPT and a SOC?
VAPT is a point-in-time test that finds weaknesses before attackers do. A security operations centre (SOC) monitors systems continuously and responds to attacks as they happen. They complement each other; one does not replace the other.
Do I need a CERT-In empanelled auditor for VAPT?
Only when a regulator or contract requires one, as some RBI, SEBI and government requirements do. Most SaaS companies testing for customers or for SOC 2 and ISO 27001 do not need an empanelled auditor. ZenoPentest does not claim CERT-In empanelment.
Get a fixed quote for your VAPT.
Tell us the application, the roles and the deadline. You get scoping questions, then a fixed quote in rupees.