What a VAPT Actually Is, and What You Receive

Somebody has asked you for a VAPT. Possibly a customer, possibly an investor, possibly an auditor, possibly a platform you want to sell through. This is what they are asking for.

Two activities, usually sold together

Vulnerability assessment is breadth. Systems are examined against known classes of weakness, largely with tooling, to produce an inventory of what is wrong. It is good at coverage and says nothing about consequence: a list of two hundred issues does not tell you which one ends your week.

Penetration testing is depth. A person attempts to use what is wrong, in sequence, the way somebody hostile would — chaining a weak setting to an exposed endpoint to reach data that was supposed to be unreachable. It is good at consequence and cannot cover everything.

Sold together as VAPT, they answer two different questions: what is wrong, and what could someone actually do. Neither substitutes for the other, and an engagement that is entirely the first is a scan with a covering letter.

What actually happens

1. Scoping. What is being tested, from what perspective, in which environment, and what is excluded.
2. Reconnaissance. Mapping what exists — including the parts you had forgotten, which is routinely where the interesting findings begin.
3. Testing. Automated coverage plus manual work on the things tooling cannot reason about: authorisation between users, business logic, sequences of legitimate actions with an illegitimate result.
4. Verification. Confirming a finding is real and reachable, not theoretical. This is what separates a report from a scanner export.
5. Reporting. Findings with evidence, severity, reproduction steps and remediation guidance.
6. Retest. Confirming the fixes worked, ideally as its own dated document.

Two to four weeks is typical for a single application, most of it in steps three and five.

What you receive

A report, and — where the engagement is being done to satisfy someone — usually a certificate or attestation letter stating what was tested and when.

The report is the deliverable that matters. The certificate is what you forward; the report is what makes your systems better, and the gap between a good one and a bad one is much larger than the gap between two prices.

What it is not

• Not a guarantee. It describes what was found in a defined scope during a defined window. It does not certify that nothing else exists.
• Not continuous. It is a point in time. The system changes the following week, which is why regulated entities are given cadences rather than a single obligation.
• Not a substitute for fixing things. An unremediated report is documentation that you knew.
• Not an audit. An audit assesses controls and process against a standard. A penetration test attacks a system. They are commissioned for different reasons and frequently confused in Indian procurement documents — worth clarifying which one a requirement means before responding to it.

How often

Annually is the common baseline, with a test after significant change — a new authentication system, a major release, a migration, a new integration handling sensitive data. Several Indian regulators set explicit cadences for the entities they supervise, and those override any general rule.

If you are buying one for the first time

Three things decide whether the engagement is worth what you pay: the scope being written down properly including exclusions, enough of the work being manual rather than automated, and the retest being included so the findings actually close.

None of those are visible in a price, and all three are negotiable before you sign.