VAPT: vulnerability assessment plus penetration testing
VAPT stands for vulnerability assessment and penetration testing. An assessment finds weaknesses; a penetration test then tries to exploit them to show what an attacker could reach.
See VAPTChecked 31 Oct 2026 · ZenoCloud Team
Assessment vs penetration test
NIST describes scanning as identifying known vulnerabilities, and penetration testing as mimicking real attacks to circumvent security features.
| Aspect | Vulnerability assessment | Penetration test |
|---|---|---|
| Question | What is weak? | What can an attacker reach? |
| Method | Scanning and checking | Hands-on exploitation |
| Result | Ranked list of findings | Validated findings, any attack paths shown |
Source: NIST SP 800-115, sections 4.3 (vulnerability scanning) and 5.2 (penetration testing).
Do I get a VAPT certificate?
A VAPT produces a report. Some tenders and auditors also ask for a certificate from an auditor empanelled with CERT-In.
We offer that as an optional upgrade. The certificate comes from the auditor, not from us.
Is a scanner report enough?
A scan lists candidates. A penetration test chains weaknesses to see what they allow together. NIST notes most tests look for such combinations.
What does VAPT cost?
Prices from our price book, before tax.
| Service | Covers | From |
|---|---|---|
| Vulnerability Assessment | One web app or up to 10 IPs, one retest | ₹25,000 |
| Penetration Test | Manual testing, scoped in writing, two retests | ₹1,49,000 |
| Continuous Security | Testing through the year | ₹3,50,000 a year |
ZenoCloud price book, 14 October 2026. Scope is agreed in writing before work starts.
Questions people ask
What is VAPT and how does it work?
A vulnerability assessment (from ₹25,000) is a scan with every finding checked by hand and one retest. A penetration test (from ₹1,49,000) is where testers try to exploit what they find, with two retests.
Who can do VAPT testing?
Anyone can sell it. Ask who tests, what the report shows, and whether a retest is included. A CERT-In certificate comes from an auditor empanelled with CERT-In.
How is VAPT different from a compliance audit?
An audit checks you against a standard. VAPT tests whether weaknesses can really be exploited. Some audits require a VAPT report as evidence.
Getting a VAPT done
A Vulnerability Assessment is ₹25,000 one-time, with one retest. Penetration tests and continuous plans are on the VAPT page.
See VAPT