VAPT testing in India: what it is, what it costs and how to prepare

What VAPT testing actually is

VAPT is two jobs done together.

1. Vulnerability assessment. The firm runs scanning tools across your app, website, APIs and servers, and lists known weaknesses: old software, missing security settings, exposed files.
2. Penetration testing. A tester then tries to use those weaknesses, by hand, the way a real attacker would. Can a normal user open the admin screen? Can one customer read another customer's invoices? Can someone guess their way past the login?

The second part is what makes it worth paying for. Scanners find settings. People find the logic mistakes: the screen that checks who you are but not what you're allowed to see.

At the end you get a report. Each finding has a severity (critical, high, medium, low), where it was found, how it was tested and how to fix it. After you fix things, the firm re-tests and issues a final report or certificate.

A VAPT is not a one-time certificate that lasts forever. It describes your app on the day it was tested. Most clients and regulators expect a fresh one every year, or after a big change.

Who's asking for a VAPT, and what they need to see

Who's asking decides what kind of report you need. Find this out first, because it changes the price.

If your client is a large company, ask them three questions before you get quotes:

1. Do you need the auditor to be CERT-In empanelled?
2. Do you need the full report, or a summary letter?
3. Which parts are in scope: the web app, the mobile app, the APIs, the cloud setup?

Those three answers can halve your quote.

Does it need a CERT-In empanelled auditor?

CERT-In is the Indian government's cyber security agency. It keeps a list of firms it has approved to do security audits. The current list on CERT-In's website has about 228 firms.

You need one of these firms when a rule says so:

• SEBI-regulated firms, for VAPT and cyber audits under SEBI's framework.
• Government websites and apps, which need a "safe to host" certificate from a CERT-In empanelled firm before they go live. The certificates we've seen are tested against the OWASP Top 10 and are valid for one year. Government apps usually also need to meet the GIGW guidelines.
• Any client or tender that asks for it in writing.

For most private clients, any credible firm will do. CERT-In empanelled firms often cost more, so don't pay for empanelment unless someone needs it. Check before you sign: the list is public on cert-in.org.in, and a firm's name should be on it on the day of the audit.

VAPT cost in India

These are typical 2026 ranges from Indian VAPT firms, before GST.

Source: TCSA, VAPT cost in India 2026. Ranges are vendor estimates and vary by scope. Prices are usually quoted before GST.

What moves the price:

• How big the app is. Firms price in tester-days. More screens, more user roles and more APIs mean more days. One Indian firm estimates about 10 days of testing for a medium app with 26–50 screens and two or three user roles.
• How deep they test. "Grey-box" testing, where you give the testers user accounts, costs more than testing from outside, but it finds the access problems that matter most.
• Manual or automated. A cheap quote is often an automated scan with a new cover page. It won't find broken access control or business-logic mistakes.
• Compliance paperwork. SEBI, RBI and government formats add reporting work.
• The re-test. Check that one re-test is included. "Re-test charged separately" can make a cheap quote expensive.

Got a VAPT quote on your desk? Send it to me for a free second opinion. I'll tell you if the scope is right, what's missing and whether you're paying for empanelment you don't need.

How long a VAPT takes

For one web app, plan like this:

1. Getting a slot: 1–2 weeks. Good firms are often booked ahead.
2. Testing: 1–3 weeks for one app. Several apps with networks and cloud take 4–8 weeks.
3. Report: a few days after testing ends.
4. Fixing: depends on what they find. A few days for settings, weeks for access-control problems built into the app.
5. Re-test and final report: usually 1–2 weeks after you say the fixes are done.

That's why the safe rule is to start 6–8 weeks before the date the report is due. The part you control is step 4. Fewer findings means a shorter step 4 and a cleaner report to send your client.

Picture Neha, who runs a B2B logistics SaaS in Pune. A large retailer wants a VAPT report before signing. She books a firm with two weeks to go. The report comes back with 14 high-severity findings, half of them simple settings. The deal waits five more weeks while her team fixes and the firm re-tests. With a pre-check a month earlier, most of those 14 would never have reached the report.

The 10 things auditors find most often

These come from the OWASP Top 10, the list most VAPT firms test against. The 2025 edition puts broken access control first again. In apps built quickly, and especially apps built with AI tools, these are the ones I see most.

1. One user can see another user's data. Change the number in the web address from invoice 1041 to 1042, and you see someone else's invoice. This is broken access control, number one on the OWASP list.
2. A normal user can open admin screens or admin APIs. The menu hides the button, but the page or API still works if you know the address.
3. Keys and secrets in the code visitors download. Payment, email or AI keys sitting in the website's JavaScript, or a .env file that's publicly readable.
4. Database rules left open. Supabase or Firebase tables that anyone can read without signing in. AI-built apps hit this one often.
5. Missing security settings. No security headers, cookies without the "secure" and "HTTP-only" flags, and old TLS versions.
6. No limit on login or OTP attempts. Anyone can try thousands of passwords or OTPs without being slowed down.
7. Sessions that never end. Logging out doesn't fully log you out, or a stolen token works for months.
8. Injection and cross-site scripting. Text typed into a form or search box is treated as code by the database or the browser.
9. Error pages that say too much. Server versions, file paths or database errors shown to visitors.
10. Old libraries with known problems. Plugins and packages that haven't been updated, with weaknesses already published online.

Most of these are quick to fix once you know where they are. The expensive part is having an auditor bill you days to find them.

How to prepare for VAPT testing in two weeks

Week 1: get the basics in order

1. Write down what's in scope. Every web address, app, API and admin panel. A firm can only quote properly on a clear list, and a clear list stops scope arguments later.
2. Set up a test copy of your app. Auditors test better, and more safely, on a staging copy with test data. It also means your live customers aren't affected.
3. Create test users for each role. Customer, staff, admin. Give the firm two users per role, so they can check whether one user can see another's data.
4. Update everything. Framework, plugins, packages, server software.
5. Turn on the security settings. HTTPS everywhere, security headers, secure cookies, limits on login and OTP attempts.

Week 2: find and fix the common problems

1. Check access by hand. Sign in as one test customer, copy the web address of their order, then open it while signed in as another. If it opens, you've found the most common high-severity finding.
2. Search the code your visitors download for keys and secrets. Move any you find to the server, and replace them with new keys.
3. Check your database rules if you use Supabase or Firebase.
4. Run a pre-check from outside. A free scan finds the settings problems in minutes. Reset's free security check covers HTTPS, headers, exposed files and, for apps, leaked keys and open databases.
5. Write down what you fixed. Auditors and clients like seeing that the team found and fixed issues before the audit.

Where Reset's audit-ready check fits

Our ₹999 audit-ready check does the week 2 work for you. We sign in as two or three test users you create, repeat every request as each one to see who can read what, run safe tests for injection and cross-site scripting on your test copy, and check sign-in and sessions. Each finding links to the OWASP standard your auditor will use, and you get a free re-check after you fix things.

What it is not: a VAPT report or a CERT-In certificate. If your client or regulator asks for a VAPT, you still need one from a security firm. The check makes that audit quicker, cheaper and cleaner.

After the report: fixing and the re-test

When the report arrives:

1. Fix critical and high findings first. These are what clients and regulators look at. SEBI-regulated firms have three months to close findings from the report date.
2. Ask the firm about anything unclear. A good firm explains how they found each issue. That's part of what you paid for.
3. Don't argue findings away. If you think one is wrong, explain why in writing. Auditors accept "this is by design, and here's why it's safe" far more readily than silence.
4. Book the re-test as soon as fixes are live.
5. Keep both reports. The first shows what was found, and the final shows it was fixed. Clients often ask for both.

If your app was built by an agency, check your contract for who pays to fix security findings. Many contracts are silent on it. It's one of the clauses worth adding, along with who owns the code.

If the fixes are small and your team is busy, Reset Tasks fixes one problem for ₹2,000, done within 3 working days, or your money back.

VAPT and India's DPDP law

From 13 May 2027, India's DPDP Rules require businesses that handle personal data to take reasonable security safeguards. That includes access controls, encryption and monitoring. The law doesn't name VAPT, but a recent VAPT report with the findings fixed is one of the clearest ways to show you took those safeguards. The penalty for failing to protect personal data goes up to ₹250 crore.

Here's what each DPDP Rule means for your business.

Frequently asked questions