Overview
In India, VAPT is the term on most tenders, audit checklists and regulator circulars, and too often it describes a scan with a certificate attached. Our VAPT keeps both halves honest. The vulnerability assessment gives breadth across every host and application in scope, and manual penetration testing proves which findings an attacker could really use. You receive one consolidated report, a closure tracker and a free retest of fixed issues.
VAPT is the term most buyers, tenders and procurement checklists use when they ask for a pentest, and it describes a deliberate pairing of two activities. The vulnerability assessment casts a wide net, using automated tooling to enumerate the full surface and flag known weaknesses across many systems quickly. The penetration test then goes deep, with testers manually confirming what is real, discarding false positives, and exploiting the issues that matter to show genuine impact.
The combination exists because neither half is sufficient alone. An assessment on its own produces a long, noisy list that still needs human judgement and tends to miss anything requiring logic or chaining. A pentest on its own gives depth but, within a fixed budget, less breadth of coverage. Together they give you both: confidence that the whole scope was examined, and proof of which findings an attacker could actually use. This is why VAPT is the default request in so many contracts.
We deliver it as one engagement with one report. The assessment runs first to map the surface and surface candidate issues; our testers then verify and exploit by hand, so what reaches you is confirmed rather than raw. Findings are scored with CVSS v4.0, prioritised by real risk, and written for both executives and engineers. Critical issues are raised the moment we confirm them, and fixed findings are retested free of charge.
How we work with Indian clients
- Fixed-price proposals in INR, with 18% GST shown separately on every invoice
- Remote-first delivery from Ahmedabad in IST working hours; on-site work can be discussed at scoping
- Signed authorisation, an NDA on request and agreed testing windows before any activity begins
- Reports and closure evidence shaped for RBI, SEBI CSCRF, IRDAI, DPDP, ISO 27001 and PCI DSS reviews
What's included
Our approach
- Scope & authorisationWe agree the full scope and obtain written authorisation to test it.
- AssessmentAutomated enumeration and scanning establish coverage and candidate issues.
- Manual testingTesters verify, exploit and chain the findings that carry real risk.
- Rating & triageConfirmed findings are scored and prioritised for remediation.
- Report & debriefOne risk-rated report is delivered and walked through with your team.
What you receive
- Single report covering assessment and penetration test
- Verified, risk-rated findings with CVSS v4.0 scores
- False positives removed before the report reaches you
- Remediation guidance for executives and engineers
- Free retest of fixed issues and an attestation letter
Standards & frameworks
- PTES
- NIST SP 800-115
- OWASP WSTG
- OWASP ASVS
- MITRE ATT&CK
- CVSS v4.0
- CWE
- SEBI CSCRF
- RBI IT Governance Direction 2023
- IRDAI Cyber Security Guidelines 2023
- CERT-In Audit Guidelines 2025
- DPDP Act 2023
Frequently asked questions
Is VAPT different from a penetration test?
It is a penetration test with an explicit vulnerability-assessment stage bundled in, which is how most contracts phrase the requirement. In practice our pentests already include that breadth-first step, so asking for VAPT or a pentest usually gets you the same engagement.
What can VAPT cover?
Any scope we test: web and mobile applications, APIs, external and internal networks, cloud and more, singly or combined. We shape the assessment and testing effort to the surface involved, so a web VAPT and a network VAPT look quite different under the same name.
Why not just run a vulnerability scan?
A scan lists potential issues from signatures and leaves triage to you, including the false positives. VAPT adds the manual testing that confirms what is exploitable, finds the logic and chained flaws a scan cannot, and gives you findings you can act on with confidence.
How often do Indian regulators expect VAPT?
It depends on the rulebook. RBI expects periodic VA/PT of critical and internet-facing systems, SEBI's CSCRF sets half-yearly VAPT for Qualified Stock Brokers, and CERT-In's 2025 guidelines call for at least one comprehensive audit a year. We help you build one calendar that covers each rule you report against.
Do you offer annual VAPT contracts?
Yes. Many Indian clients prefer a yearly agreement that covers two or more VAPT cycles plus retests, priced in INR with GST shown separately. Scope is reconfirmed before each cycle so the price stays accurate.