What Is VAPT? The 2026 Guide for Indian Businesses (Process, Compliance, Cost)

VAPT explained for 2026: what vulnerability assessment and penetration testing is, why India's average breach now costs ₹220M, and what CERT-In and DPDP require.

By Prathamesh Dabir

A bad assumption almost cost one of our clients their largest account. They believed their web app was safe because an automated scanner had given it a clean bill of health. Three days into a penetration test, my team took two findings the scanner had filed as "low" and chained them into full read access on the order database. The scan never flagged it. That gap, between a tool that looks satisfied and an attacker who actually gets in, is the entire reason VAPT exists.

I'm Prathamesh Dabir. I work on security operations and threat intelligence at Arica Tech Security in Pune, and I've run or reviewed enough of these tests to tell you where the real risk usually hides. This guide walks through what VAPT is, how it works, what Indian regulators now demand in 2026, and what you should expect to pay.

One number sets the stakes. India's average data breach hit ₹220 million in 2025, an all-time high, and IBM's 2026 update shows Indian breach costs still rising, up roughly 7% (IBM, Cost of a Data Breach Report 2025).

Key Takeaways

  • VAPT pairs a vulnerability assessment (broad, automated discovery) with a penetration test (manual, proof-driven exploitation). You need both.
  • It's no longer optional for many Indian firms. RBI, SEBI's CSCRF, CERT-In and the DPDP Rules 2025 all now point to regular testing.
  • A typical web-app VAPT runs 5 to 10 working days and costs ₹1.5 to 4 lakh per scope in India.
  • For regulated work, the testing must come from a CERT-In empanelled auditor, with both CVSS and EPSS scoring in the report.

What Is VAPT, Exactly?

VAPT stands for Vulnerability Assessment and Penetration Testing. They're two security tests that run as a pair. The assessment scans widely to find weaknesses across your apps, networks and cloud. The penetration test then takes a qualified human and has them try to break in for real, chaining those weaknesses to show what an attacker could actually reach. The assessment gives you the wide view. From there, the penetration test shows which of those gaps someone can walk straight through.

Why bundle them? Because each one covers for the other's blind spot. A scanner can check thousands of known issues in minutes, but it can't reason about your business logic or string three small flaws into one serious breach. A human tester can do exactly that, but won't manually re-check every patch level across 400 servers. Run together, you get coverage and confirmation.

A vulnerability assessment finds the unlocked doors and windows. A penetration test sends someone to climb through one and tell you what they walked out with. By 2026, treating these as a single engagement has become the working definition of VAPT across most Indian audit frameworks, including the CERT-In audit guidelines and SEBI's CSCRF.

The client I opened with is the pattern, not the exception. In most assessments my team runs, the finding that actually matters isn't a single critical bug. It's two or three medium issues that a scanner rates in isolation, then a person connects into one clean way in. That linking step is the whole job, and it's the part automation still can't do.

Vulnerability Assessment vs Penetration Testing: What's the Difference?

In short, a vulnerability assessment tells you what might be wrong, and a penetration test tells you what an attacker can actually do about it. Most of the value in a serious engagement comes from that second step, because exploitation is where theoretical risk turns into a demonstrated breach you can show a board.

Here's how they compare:

Vulnerability Assessment Penetration Testing
Method Mostly automated scanning Mostly manual, by a tester
Goal Find and list weaknesses Exploit them, prove impact
Depth Wide, shallow Narrow, deep
Output A ranked list of CVEs A story: how far an attacker got
Business logic flaws Usually missed Found
Frequency Often continuous Periodic, per release or per year

So which do you need? If you're asking, you almost always need both, run as one VAPT engagement. The assessment keeps the list current. The penetration test catches the things the list can't see. For a deeper split between the two, see our vulnerability assessment and penetration testing services.

Why Does VAPT Matter for Indian Businesses in 2026?

Because the cost of getting breached in India is now the highest it has ever been. The 2025 figure of ₹220 million per breach climbed 13% in a single year, and India ranked as the costliest country in IBM's global study (IBM, Cost of a Data Breach Report 2025). For a mid-sized company, one incident can erase a year of profit.

Money is only part of it. Three other pressures have pushed testing onto the board agenda:

  • Cyber insurance. Insurers now ask for proof of recent VAPT before they quote, and they price the premium on what they see.
  • Client trust. Enterprise buyers and government tenders increasingly want a recent test report as a condition of signing.
  • Regulation. The bigger shift, and the one most teams underestimate, is legal. More on that next.

By 2026, VAPT has shifted from a security nice-to-have to a business control that touches compliance, insurance eligibility and sales. A single breach in India now averages ₹220 million (IBM, 2025), which means the test that would have caught it is one of the cheapest line items you'll ever approve.

Is VAPT Mandatory in India? (RBI, SEBI, CERT-In, DPDP)

For a fast-growing list of Indian organisations, the honest answer is yes. No single law says the literal word "VAPT is compulsory for everyone," but four regulators have made regular testing the practical baseline for anyone holding sensitive data or operating in a regulated sector.

Authority / law What it expects Who it applies to
RBI Cyber Security Framework Annual VAPT Banks, NBFCs, payment aggregators
SEBI CSCRF Annual VAPT, bi-annual for market infrastructure, reports only from CERT-In empanelled auditors SEBI-regulated entities
CERT-In Audit Guidelines (25 July 2025) CVSS + EPSS scoring, recognised frameworks, now covers AI, blockchain and IoT Audited entities across sectors
DPDP Act 2023 + Rules 2025 "Reasonable security safeguards," breach reporting, encryption Any business processing personal data
ISO 27001:2022 (Annex A 8.8) Documented technical vulnerability testing Anyone seeking certification

A few of these deserve a closer look.

The CERT-In Comprehensive Cyber Security Audit Policy Guidelines, issued on 25 July 2025, raised the bar for what a report must contain. Every finding now needs both a CVSS score for severity and an EPSS score for exploit likelihood, so you can rank by what's genuinely dangerous, not just what's theoretically bad. The 2025 policy also pulled AI, blockchain and IoT systems into scope (CERT-In, 2025).

The DPDP Rules 2025 were notified in mid-November 2025, and they set a clock that 2026 is for. Full compliance for data fiduciaries lands on 13 May 2027, with penalties reaching ₹250 crore for failing to maintain reasonable security safeguards (India Briefing / EY, 2025). Serious breaches must be reported quickly, within 72 hours for high-impact incidents.

That May 2027 deadline sounds far away, which is exactly why it keeps slipping down priority lists. It shouldn't. A first VAPT almost always uncovers fixes that take engineering quarters, not weekends, to close. If you start your testing cycle in 2026, you have room to remediate and re-test before the deadline. Start in 2027 and you're showing the regulator a list of open findings instead of a clean closed one.

How Does the VAPT Process Actually Work?

A real engagement follows seven phases, aligned to standards like PTES and the OWASP testing guides. The execution itself usually takes 5 to 10 working days for a single scope, so timeline questions almost always come down to how many scopes you have, not how slow the testing is.

  1. Scoping. Agree exactly what's in and out: which apps, networks, APIs and accounts. This is where most engagements quietly succeed or fail.
  2. Reconnaissance. The tester maps your attack surface the way an outsider would.
  3. Vulnerability assessment. Automated and manual discovery across the scope.
  4. Exploitation. The penetration test proper. Confirmed weaknesses get exploited and chained.
  5. Post-exploitation. How far can the access go? Lateral movement, data reach, privilege gain.
  6. Reporting. Every finding documented with proof, impact and a fix.
  7. Re-test. After you patch, the tester verifies the fixes actually held.

That last phase gets skipped far too often, and it's the one regulators care about most. Closing a finding means someone re-ran the original attack and watched it fail, not that a developer ticked a box in a tracker.

What Does a Good VAPT Report Look Like?

Penetration tester reviewing a security dashboard with network graphs and severity ratings

A good report does one thing above all: it lets a non-security executive understand the risk in five minutes and gives an engineer everything needed to fix it. Since the CERT-In 2025 guidelines, every finding should carry a CVSS score (how severe) and an EPSS score (how likely it is to be exploited in the wild), so you can triage by real danger.

For each finding, you want five things: what it is, where it lives, proof it's real, the business impact in plain words, and the exact fix. No proof, no finding. A vulnerability "report" that's really a raw scanner export isn't a VAPT report, and a CERT-In empanelled auditor won't hand you one.

The reports my team is proudest of are the ones a CFO actually reads. We've learned to put the attack path on page one as a short narrative ("started with this, ended with your customer data") and keep the 60-page technical appendix for the engineers. If a CFO can't follow the risk, it never gets the budget to fix it.

How Much Does VAPT Cost in India, and How Long Does It Take?

For a single, moderate-complexity scope, expect roughly ₹1.5 to 4 lakh for a web application, and ₹2 to 5 lakh for a mobile app, with most engagements wrapping execution in 5 to 10 working days plus a few days for reporting and one re-test (market data, 2026). Network and internal Active Directory tests sit in a similar band.

What moves the price? Three things, mostly. The number of scopes. The complexity of each app, where a single login form costs far less to test than a multi-tenant platform with 200 API endpoints. And the seniority of the testers, because a CERT-In empanelled team with OSCP or CREST-certified staff costs more and earns it on regulated work. If you're booking VAPT to hit a compliance date, build in time for remediation and the re-test, not just the test itself. Want a scoped quote for your stack? Talk to our team.

How Do You Choose a VAPT Provider?

Start with one filter that removes most of the risk: is the provider CERT-In empanelled? For anything tied to RBI or SEBI, empanelment is mandatory, because those regulators only accept reports from empanelled auditors. After that, four questions sort the serious firms from the scan-and-bill shops.

Do they do genuine manual testing, or just run a tool and reformat the output? Do their testers hold recognised certifications like OSCP, CREST or CEH? Is a re-test included so you can prove fixes held? And can they show you a sample report (sanitised) so you know what you're buying? A provider who can't answer those cleanly is selling you a scan with a nicer cover page. You can see how we approach this in our case studies.

Frequently Asked Questions

Is VAPT the same as a security audit?

No. A security audit checks your policies, processes and controls against a standard like ISO 27001. VAPT is a technical test that actually attacks your systems to find exploitable weaknesses. Audits ask "do you have a control?" VAPT asks "does the control hold when someone pushes on it?" Most mature programmes run both, since ISO 27001:2022 Annex A 8.8 expects technical testing anyway.

How often should we run VAPT?

At minimum once a year, which is what RBI and SEBI's CSCRF require for regulated entities, and bi-annually for market infrastructure institutions (SEBI CSCRF, 2024-25). Beyond the mandate, test after any major release, infrastructure change or migration. Code changes faster than an annual cycle, and so does your attack surface.

Does a vulnerability scan satisfy CERT-In or RBI requirements?

Usually not on its own. A scan is the assessment half of VAPT. Regulators and the CERT-In 2025 guidelines expect manual penetration testing, exploitation evidence, and both CVSS and EPSS scoring, delivered by a CERT-In empanelled auditor. An automated scan report alone tends to fail that bar.

What's the difference between VAPT and a bug bounty?

A VAPT is a scoped, time-boxed test by a known team, with a formal report you can hand a regulator. A bug bounty is open-ended, crowd-sourced, and pays per valid bug found. They complement each other. VAPT gives you compliance-grade coverage on a schedule, while a bounty gives you continuous pressure from many eyes. Bounties don't replace the report an auditor needs.

Will VAPT cause downtime?

Rarely, when it's scoped well. Most testing runs against staging or is rate-limited against production, and any genuinely disruptive test (like a denial-of-service check) is agreed in writing first and run in a window you control. This is exactly what the scoping phase is for. A good tester protects your uptime as carefully as they probe your defences.

The Bottom Line

VAPT is how you find out whether your security actually works before an attacker does it for you, and in 2026 it's both a regulatory expectation and a sound business bet against a ₹220 million average breach. If you're an Indian business holding customer data, you'll be testing sooner or later. The only real question is whether it's done, fixed and re-tested before your compliance clock, and the DPDP deadline of May 2027, runs out.

If you're scoping your first engagement or replacing a provider who only ever sent you scans, that's the work my team does every week. Start with our VAPT services, or reach out and we'll help you scope it properly.

About the author: Prathamesh Dabir works on security operations and threat intelligence at Arica Tech Security, a Pune-based cybersecurity firm specialising in VAPT, ISO 27001, and secure software development. He has run and reviewed penetration tests across web, mobile, API and network environments for Indian businesses.

Sources

Need this in your own environment?

Arica Tech Security runs VAPT, ISO 27001 readiness support, and digital forensics engagements for teams in India and beyond.

Talk to our team Explore services