Every VAPT quote in India, however it is packaged, comes down to one sum: the tester-days your scope needs, multiplied by the day rate of the people doing the work, plus time for reporting and a retest. Per-IP bundles, per-app packages and annual contracts are only different wrappers around that effort. Learn what pushes the day count up and comparing quotes gets much easier, and a low figure that is really a scanner run stands out.
Indicative VAPT prices in India, 2026
The first table draws on published 2026 Indian market guides. Each row assumes one clearly scoped engagement with a report. Treat the numbers as a starting point for budgeting, not as a quote from anyone.
| Target | Typical testing days | Indicative range (plus GST) |
|---|---|---|
| Static website | 3–5 days | ₹40,000 – ₹90,000 |
| Moderate web application | 6–12 days | ₹1,20,000 – ₹3,50,000 |
| Large multi-tenant SaaS | 3–6 weeks | ₹4,00,000 – ₹12,00,000+ |
| Mobile app (per platform) | 5–10 days | ₹1,00,000 – ₹3,00,000 |
| API (50–150 endpoints) | 5–12 days | ₹1,00,000 – ₹4,00,000 |
| External network (up to about 256 IPs) | 4–8 days | ₹60,000 – ₹2,00,000 |
| Internal network and Active Directory | 1–3 weeks | ₹1,50,000 – ₹6,00,000 |
| Cloud configuration review | 5–10 days | ₹1,00,000 – ₹3,50,000 |
Another 2026 guide gives lower entry points for smaller scopes, which is useful if you are a start-up or a single-product company.
| Target (smaller scope) | Indicative entry range (plus GST) |
|---|---|
| Web application | ₹40,000 – ₹1.5 lakh |
| API | ₹40,000 – ₹1.2 lakh |
| Mobile app | ₹50,000 – ₹1.5 lakh |
| External network | ₹30,000 – ₹1 lakh |
| Internal network | ₹60,000 – ₹2 lakh |
| Cloud | ₹50,000 – ₹1.5 lakh |
The two sets of figures overlap rather than conflict: the lower table describes compact scopes, the upper one fuller engagements. Our calculator works from tester-days at ₹12,000 to ₹30,000 per tester-day, a rate band derived from these published ranges.
What pushes the number up or down
Size of the target
For applications, effort grows with user roles, screens, API endpoints and complex journeys such as payments, loan approval, KYC and multi-tenant administration. On networks, the drivers are live hosts, the number of locations and how sprawling the domain is. In cloud, what counts is how many accounts or subscriptions you run and how many different services each one uses. A clean asset list is the single most useful thing to send with a request for a quote; our scoping article shows how to build one.
Manual work versus scanning
Scanners are quick and cheap, and they have a place. They do not find broken access control between roles, business logic abuse or chains of small weaknesses, which is where most serious breaches start. Ask every bidder how many days are planned and how many of them are hands-on.
How much you tell the testers
Grey box testing, with accounts and documentation, usually gives the best value. Black box testing spends paid days rediscovering what your team already knows. White box with source code costs more and reaches deepest. See black, grey or white box for the trade-offs.
Regulatory reporting
Reports for RBI, SEBI CSCRF, IRDAI, PCI DSS or ISO 27001 can need method statements, control mapping, closure tracking and an attestation letter. If an audit must be carried out by a CERT-In empanelled auditor, pricing may differ again. Our CERT-In audit guide explains when that applies.
Timing and logistics
Testing windows outside business hours for trading, payment or hospital systems take more planning. A start date inside two weeks usually costs extra. Remote delivery avoids travel, and most internal tests run over VPN or a small device shipped to your office; where an on-site visit is needed, it adds cost.
GST
Security testing services supplied in India carry 18% GST. Most quotes show prices before GST, so check before comparing totals. On a ₹2,00,000 quote, for example, the invoice comes to ₹2,36,000.
Pricing models you will see
- Fixed price per engagement. What most Indian buyers receive. It works well when the scope document leaves nothing open to interpretation.
- Per-asset bundles. "Per IP" or "per application" offers. Ask how much testing time each asset actually receives.
- Annual VAPT contracts. Popular with regulated entities that need half-yearly or yearly cycles with retests.
- Continuous testing subscriptions. Suit teams that release weekly; compare the depth of testing behind each fee. See continuous pentesting.
- Day rate. Common for red teams and for environments that are still changing.
Spending less without testing less
- Hand over credentials and documents, such as Postman collections and a list of roles, so testers start testing on day one.
- Clear the easy issues first. Patch, harden and run your own scan, so the paid days go on deeper problems.
- Offer a stable staging environment with realistic but non-personal data.
- Test connected systems together. A portal, the API behind it and the cloud tenancy that hosts both can share one kick-off, one set of accounts and one report.
- Book ahead of audit season. Last-minute VAPT before an RBI inspection or a SEBI submission costs more and leaves no time to fix and retest.
- Agree the retest at the start. Closure evidence matters as much as the report. With us, a retest of fixed findings is part of the price.
Red flags in a cheap quote
- A figure arrives by return email, with no questions about roles, endpoints or hosts.
- A complete web application assessed and reported within forty-eight hours.
- No named methodology, no sample report and no answer on manual effort.
- A sample report full of tool output and plugin numbers, with no steps a developer could follow.
- A CERT-In empanelment claim you cannot find on CERT-In's published list.
- No retest, or a retest billed as a fresh engagement.
- A "VAPT certificate" offered without any report behind it.
Frequently asked questions
Are VAPT prices in India quoted with GST?
Most providers quote excluding GST and add 18% on the invoice. When you compare bids, put every figure on the same basis before you look at the total.
Why do two VAPT quotes for the same app differ so much?
Usually because they plan different numbers of tester-days, or one is mostly automated scanning. Ask each bidder for the planned days, the share of manual work and a sample report.
Is there a fixed VAPT price per IP or per application?
Some providers package it that way, but the cost underneath is still tester effort. A per-IP or per-app price only makes sense once you know how much testing time each asset receives.
Ready to compare quotes? Run your scope through the cost calculator, then ask for a fixed-price VAPT proposal in INR. You can also browse our VAPT services.