Vulnerability Assessment & Penetration Testing
Vulnerability assessment and penetration testing (VAPT)
Vulnerability scanning followed by hands-on exploitation, so you know which weaknesses an attacker could use.
- Valid for
- 1 year
- Guidelines
- CERT-In
- Verification
- QR and register
Accredited and empanelled
What is VAPT?
Vulnerability assessment and penetration testing combines two kinds of work. The assessment uses scanners and configuration review to list known weaknesses across your systems, and the penetration test has our testers try to exploit them, chaining issues together the way a real attacker would.
We test networks and infrastructure, web applications, APIs, mobile apps, cloud configurations and wireless networks, following the OWASP Web Security Testing Guide v4.2, NIST SP 800-115 and the Penetration Testing Execution Standard (PTES). Every engagement starts with written rules of engagement covering scope, timing and the actions we will not take.
After your team fixes the findings, we re-test them. The certificate is issued once all critical and high-severity findings are closed, and it records the assessment type, the assets in scope, the assessment dates, the methodology and the report reference.
Who it is for
- Companies with internet-facing infrastructure or applications
- Organisations preparing for ISO 27001 certification or surveillance audits
- Payment businesses with PCI DSS penetration testing requirements
- Regulated entities with periodic VAPT requirements
- Software vendors asked for test evidence by enterprise customers
- Organisations after a major migration, merger or new release
What sets audit time and cost
Typically one to three weeks of testing for a defined scope, followed by re-testing once your team has fixed the findings.
- Number of IP addresses, hosts or applications in scope
- Black-box, grey-box or white-box approach
- Internal testing that needs on-site or VPN access
- Number of user roles and API endpoints
- Testing restricted to off-peak windows
- Number of re-test rounds
Why it matters
What VAPT gives you
- 01
Real risk, not a scanner list
Exploitation shows which findings lead to data access or system control, separating urgent issues from noise.
- 02
Attack paths made visible
Chained findings show how small weaknesses combine, which helps you fix the link that breaks the chain.
- 03
Evidence for audits and customers
Reports and closure certificates support ISO 27001 audits, PCI DSS assessments and customer security reviews.
- 04
Measured improvement
Re-tests confirm each fix, and repeat engagements show how your exposure changes over time.
The audit
What our auditors examine
- 01
External and internal network
Open ports, exposed services, weak protocols, default credentials and lateral movement from an internal foothold.
- 02
Active Directory and privilege escalation
Weak service accounts, excessive permissions and paths from a standard user to domain administrator.
- 03
Web applications and APIs
OWASP Top 10 and OWASP API Security Top 10 risks, including broken object-level authorisation, injection and authentication flaws.
- 04
Mobile applications
Android and iOS apps tested for insecure storage, weak transport security, exposure to reverse engineering and abuse of backend APIs.
- 05
Cloud configuration
Over-permissive identities, public storage, unencrypted data, missing logs and permissive network rules in your cloud accounts.
- 06
Wireless networks
Encryption settings, guest network separation, rogue access points and the reach of corporate Wi-Fi beyond your premises.
How the audit runs
Audits follow CERT-In guidelines from scoping to the final certificate, with re-testing until findings are closed.
01
Scoping
We agree the applications, URLs, APIs, networks or assets in scope, the test environment and the rules of engagement.
02
Testing
Auditors test against CERT-In guidelines and recognised methods such as the OWASP Testing Guide, using automated tools and manual techniques.
03
Findings report
Each finding comes with its severity, evidence and the risk it poses. Your team fixes them in the audited environment.
04
Re-testing
We re-test until findings are closed or formally accepted, and record the version that was finally audited.
05
Certificate and report
The final report and certificate are issued, and the certificate is listed in the public register with a QR code for verification.
Related standards and audits
Often certified or audited alongside this one, sometimes in a single combined audit.
Security audits
Web application security audit
Testing of your web application against OWASP guidance, with a certificate that names the URLs, dates and build covered.
Security audits
IT security audit
An information security audit to CERT-In guidelines covering the systems you name, closed with a dated audit certificate.
ISO certification
ISO 27001
Independent certification of your information security management system against ISO/IEC 27001:2022.
Security audits
Safe-to-host certificate
A security audit to CERT-In guidelines, ending in a certificate tied to the exact build you will host.
Industries we audit for
Banking and fintech
Audits and certifications that support the security evidence regulators, partner banks and payment networks ask for.
SaaS and cloud
Independent evidence that answers enterprise security reviews and keeps sales moving.
Healthcare and life sciences
Quality and information security certification for organisations where patient safety and patient data both matter.
VAPT questions
We audit; we do not consult.
To keep audits independent, we never design, build or fix the systems we audit, and decisions are made by people who did not take part in the audit. Read our impartiality policy.
Plan your VAPT audit
Tell us your scope, sites and timeline. We reply with an audit plan and a fixed quote.