Free guide
VAPT Scoping Guide
How to scope and buy a security test. Learn the difference between a vulnerability assessment and a penetration test, decide what goes in scope, prepare your team and systems, and check that the report is one your developers, customers and auditors can use.
PDF · 14 pages · Updated October 2026
For: Founders, CTOs and engineering leads who need a security test and want to buy the right one.
Get the guide
What’s inside.
- VA, PT and VAPT in plain words
- Why you are testing decides the scope
- What to put in scope
- Black, grey and white box
- Choosing the depth
- Preparing for the test
- What a good report contains
- After the report
- One-page checklist
What you’ll be able to do.
- Tell a vulnerability assessment from a penetration test, and know which one you were asked for.
- Decide what goes in scope: apps, APIs, cloud accounts, user roles.
- Prepare authorisation, test accounts and a testing window.
- Know what a good report contains, and the signs of a bad one.
- Know when you need a CERT-In empanelled auditor’s report.
Rather have us do it?
VAPT, run by our 24/7 team. We reply within one business day.