VAPT testing: what it involves, and what it should cost you
VAPT (vulnerability assessment and penetration testing) is something most buyers have never bought before. These guides cover scope, cost, qualifications and how to read the report.
Start here
Scope your test
Say what needs testing and see the effort it takes, with the reason each answer moved the number. It runs in your browser and gives tester-days, which is the unit a quote is built from.
The engagement
What a VAPT engagement covers
The engagement types, what each one reaches, the effort each takes in tester-days, and what arrives at the end. Security Brigade has been CERT-In empanelled since 2008.
Latest guides
VAPT Tools: What a Tester Uses at Each Phase, and Where Each One Stops
The tools a tester runs in each phase of a VAPT, what each produces, and where a person has to take over.
How the testing works
VAPT When No Regulator Requires It
Unregulated companies still end up buying penetration tests. The requirement arrives through customers, contracts, insurers and investors, and…
Where the requirement comes from
Which Indian Regulators Require Security Testing
Which regulator binds you, what instrument sets the requirement, and where to read the detail that applies to your entity type.
Where the requirement comes from
26 guides, published by Security Brigade and last updated .
How the testing works
What a tester actually does, by asset class, and what tooling does and does not reach.
- VAPT Tools: What a Tester Uses at Each Phase, and Where Each One Stops
- What a Scanner Finds, and What It Cannot
- The Phases of a Penetration Test
- External and Internal Network Penetration Testing
- Mobile Application Security Testing, Explained
- API Penetration Testing, Explained
- Web Application Penetration Testing, Explained
Scope and preparation
What to have ready, what can and cannot be tested, and how the boundary gets drawn.
Reading the report
Severity, CVSS and the vector string, and how to tell written work from tool output.
After the test
Sequencing the fixes, proving closure, and deciding when to test again.
Where the requirement comes from
Which regulators name you, and where the obligation arrives from when none do.
Buying one
What it costs, who is qualified to do it, and what you receive at the end.
Applying this to your own estate
Get a VAPT scoped against what you actually run.
Application count, environment, regulator and evidence deadline are what move a scope. A template does not know any of them. Describe your estate and you will get the scope, the cost and the retest cadence in writing. Security Brigade is CERT-In empanelled and publishes this site.