How a VAPT Scope Gets Sized
A tester sizes the work by counting functions, roles and entry points. That count becomes the number of days, so the detail in your brief decides how accurate the quote is.
Ask three vendors to quote the same system and the estimates can differ by a factor of two. Overcharging is rarely the reason. Each vendor was given different information and made different assumptions about what was in scope.
Understanding what a tester actually counts makes those quotes comparable.
What is not the measure
Lines of code. A hundred thousand lines implementing four screens is a small test. Ten thousand implementing a permission system with six roles is not.
Number of servers. Forty identical web servers behind a load balancer are approximately one target.
Number of microservices. If thirty services sit behind one gateway and expose twelve endpoints between them, the attack surface is twelve endpoints.
All three measure how much was built. Testing time follows how much can be reached.
What a tester counts
Web applications
Distinct functions, not pages. A list view and its detail view are one function; a search, an export and a bulk edit are three. Then the number of roles, because each one multiplies the authorisation testing. Then the authentication surface: login, registration, password reset, multi-factor, single sign-on, session handling. Administrative interfaces count separately, because they are usually a different application wearing the same brand.
APIs
Endpoints and the methods on them. Distinct authentication schemes. Whether the specification is trustworthy. If it is out of date, the tester has to establish reality first, and that is discovery time. For GraphQL, count the types and resolvers, not the single HTTP endpoint.
Mobile
Platforms multiply. Android and iOS sharing one backend is three targets: two binaries with platform-specific issues, plus the API tested once. A quote that treats two platforms as one has either scoped one of them thinly or intends to skim.
Networks
Live hosts with services listening, not address space. A /16 that is 3% populated is smaller than a fully occupied /24. None of that is known before discovery, so network quotes often price a discovery phase separately.
What legitimately inflates a scope
- More roles. A necessary cost: authorisation testing is where the serious findings are, and it needs the accounts.
- Bespoke authentication or signing. A custom scheme costs a day or more before testing starts.
- Complex multi-step workflows. Where the business logic flaws live.
- Genuinely different components. A React front end, a legacy admin panel and a mobile app are three exercises.
What inflates it unnecessarily
- Multiple environments. Testing staging and production when they are the same build is buying the same test twice.
- Repeated identical instances. Forty deployments of one product is one test plus a configuration comparison.
- Scoping by asset register. Registers include things that were decommissioned, and exclude things nobody wrote down. The external discovery phase is the corrective.
How to brief for an accurate quote
Six items, and they take under an hour to assemble:
- What the system does, in two sentences.
- The roles, and what distinguishes them.
- A rough count of distinct functions. An estimate is fine.
- The technology, and anything unusual about authentication.
- Whether an API is in scope as a target in its own right, or only as the thing the front end talks to. This single question accounts for more quote variance than any other.
- Any hard constraints: change freezes, environments, third-party components you cannot authorise.
Give all vendors the same brief. Otherwise you are comparing quotes for different pieces of work and choosing the one that assumed least.
Reading the quotes
Convert everything to tester-days. That is the unit vendors actually price in, and it makes proposals comparable when their packaging is not.
Then check three things: whether reporting time is included in the day count or added, whether retesting is included, and what the daily rate implies about who is doing the work. A quote at half the price of the others means fewer days, less experienced people, or a scope that quietly dropped the API.
A fixed price offered before anyone has seen the system was set by guessing at the scope, and the risk of that guess is priced in somewhere. It may still be a fair price.
What those days cost and why is in what moves the price of a penetration test. What falls outside the boundary regardless of budget is in what can and cannot be tested.
About the author
Abhinav A
Lead — VAPT & Security Assessments
Leads Security Brigade's VAPT delivery team, having progressed from Security Consultant to Team Lead. Has executed advanced penetration tests across BFSI, fintech, QSR and telecom.
Continue reading
All articles →VAPT When No Regulator Requires It
Unregulated companies still end up buying penetration tests. The requirement arrives through customers, contracts, insurers and investors, and each of them wants something slightly different.
Which Indian Regulators Require Security Testing
Which regulator binds you, what instrument sets the requirement, and where to read the detail that applies to your entity type.
Writing a VAPT RFP That Gets Comparable Quotes
Most VAPT tenders return responses that cannot be compared. Four ways an RFP causes that, and what to specify instead so three proposals answer the same question.