What is VAPT? A plain-English guide for startup founders

VAPT in one sentence

VAPT stands for Vulnerability Assessment and Penetration Testing. It's an authorised security test of your website, app or API that finds weaknesses and then proves how far an attacker could get with them.

The two halves

Vulnerability assessment (VA)

A broad sweep that looks for known weaknesses: outdated software, missing patches, risky settings, exposed files. It uses automated scanners plus manual checks, and answers the question "what's wrong?"

Penetration testing (PT)

A skilled tester actively tries to break in the way a real attacker would — chaining small issues together, abusing logins, permissions, APIs and business logic. It answers the question "what could someone actually do with it?"

A scanner might report that a page is "potentially vulnerable". A penetration test shows whether that really lets someone read your customer database. That difference is why a scan alone rarely satisfies a client's security team.

When does a startup need VAPT?

• An enterprise client asks for it. Larger companies often require a recent third-party security test before they'll sign or connect to your product.
• Before fundraising. Investors increasingly ask about security in due diligence, especially for fintech, health and B2B SaaS.
• Compliance. Frameworks like ISO 27001 and SOC 2, and many regulated industries, expect regular security testing.
• Before a big launch or after a major change — new payments, a public API, user roles or a rebuild.
• At least once a year, because your code and the threats both change.

Some government and regulated projects in India specifically require audits by a CERT-In empanelled auditor. If your contract mentions this, check the requirement before choosing a provider.

Black box, grey box or white box?

• Black box — the tester starts with nothing but your URL, like an outside attacker. Realistic, but slow to reach deeper features.
• Grey box — you provide normal user accounts (for example one per role). This finds far more in the same time and is the best value for most startups.
• White box — the tester also sees source code or architecture documents. The most thorough, and useful for high-risk systems.

What happens during a VAPT

1. Scoping. You agree what's in scope (domains, apps, APIs), the test type, dates and price.
2. Authorisation. You sign written permission. Testing without it is illegal, so a serious provider will always insist.
3. Testing. Usually following recognised methods such as the OWASP Testing Guide and the OWASP Top 10 risks.
4. Reporting. Every finding is rated by severity, with evidence and fix guidance.
5. Fixing and retesting. Your team fixes the issues; the tester confirms they're closed and updates the report.

What a good VAPT report includes

• An executive summary a non-technical founder or client can understand.
• The scope, dates and method used.
• Each finding with a severity rating (often based on CVSS), proof, the business impact and clear steps to fix it.
• A retest status for each finding, so you can show clients the issues are resolved.

If a report is just a long export from a scanning tool with no proof and no prioritisation, it isn't a penetration test. See a sample of how we present findings.

How long does it take, and what does it cost?

It depends on size and depth. A small web app with a few user roles typically takes one to two weeks including the report. Price depends mostly on the number of pages, features, roles and APIs in scope — so always ask for a fixed quote based on a clear scope rather than an open-ended day rate.

How to choose a VAPT provider: questions to ask

• How much of the testing is manual, and how much is automated scanning?
• Can I see a sample report?
• Is a retest included after we fix the issues?
• Will you sign an NDA and require written authorisation?
• How do you avoid disrupting our live service? Can you test staging?
• Will you tell us immediately if you find something critical?