Penetration testing

VAPT services for software that keeps changing.

You ship every week. We test what you ship: AI finds more, our testers prove it.

Scope my pentest View a sample VAPT report

Penetration Test from ₹1,49,000. Not ready? Start with a free exposure check.

Over the shoulder of a ZenoCloud security tester at night: a network map with one attack path highlighted in red and a printed findings sheet beside the keyboard. — Illustrative attack path: entry point → API → customer data.

Businesses we’ve hosted and supported since 2009

What is VAPT?

VAPT means vulnerability assessment and penetration testing. The assessment finds security weaknesses in your web app, API and servers. The penetration test exploits them to prove the real impact, so you fix what matters first.

Two ZenoCloud security testers in navy branded clothing trace an attack path on a monitor and take notes late in the evening.

How our VAPT testing works

AI finds. People prove.

AI is fast but probabilistic. Security needs proof, and someone who signs for it.

AI finds more, faster: AI-assisted discovery maps endpoints, roles and likely paths in.
Deterministic checks: Rule-based tools confirm what is really exposed.
People prove it: In-house testers exploit each finding by hand and sign the report.

Security testing for vibe-coded apps

Vibe-coded apps need an audit.

AI tools write working code fast, and miss the security basics. We audit it before your customers, or attackers, find out.

Access control: Can one user see another user’s data? AI-written code often skips the check.
Secrets: API keys and database passwords left in the code or the browser.
Inputs and APIs: Unchecked inputs, open endpoints and no rate limits.

The report

See a sample VAPT report.

Critical findings within 24 hours. Your full report within 10 business days.

Findings · 2 of 6Page 9

Finding F-02

Customers can read and change other customers' orders

High CVSS 8.1

Summary: The order API checked login status but omitted ownership checks on reads and delivery-address updates. A customer could enumerate sequential order identifiers and access orders belonging to other customers.
Evidence: Synthetic capture using customer A's session: PATCH https://api.yourstore.com/v1/orders/48216 HTTP/1.1; body {"deliveryAddressId":"addr-A2"} → HTTP/1.1 200 OK. Customer B owned the order; a subsequent GET confirmed the changed address and exposed B's contact details.
Fix: Enforce object ownership and store boundaries before every order read or mutation. Verify address ownership separately. Add negative authorisation tests across customer accounts, stores and roles; unpredictable identifiers alone are insufficient.
Retest: Fixed Cross-customer reads and updates returned 403; legitimate ownership checks passed across both customer accounts and store assignments.

You also get a signed Letter of Attestation to send your customers. Read the full sample →

Report guarantee. If your customer or auditor asks for changes to the report, we revise it at no cost.

A ZenoCloud security consultant in a navy branded jacket walks a startup CTO through the findings in a printed VAPT report.

After the report

Review findings. Keep testing what changes.

A 60-minute readout with your tester and two retests in 60 days. Ship weekly? Continuous Security retests at each major release.

Testing by our in-house team, OSCP- and CEH-certified. Keep fixed issues closed with Managed Cloudflare.

Start free

Get a free exposure check.

We check what the internet can see of your app and send a one-page summary in 2 business days.

For agencies

Sell VAPT to your clients.

Your clients get asked for a pentest before launch. Add it to every project and keep the margin.

Partner programme

Your name on it: Report and Letter of Attestation under your agency’s brand.
Your margin: Partner pricing. You set what your client pays.
Our testers: We scope, test and run the readout. You keep the client.

Pricing

VAPT pricing.

Vulnerability Assessment

Validated scanning

₹25,000per engagement

Book an assessment

Penetration Test

Manual authenticated testing

From ₹1,49,000per engagement

Scope a pentest

Continuous Security

Recurring testing

From ₹3,50,000a year

Scope a programme

Report guarantee on every tier. Optional CERT-In audit certificate. Read our VAPT cost guide or the free VAPT scoping guide.

What each tier includes

Vulnerability Assessment

One web application, or up to 10 external IPs. Automated assessment with every finding checked by hand and false positives removed. Not a penetration test, and the report says so.

OWASP Top 10 basics, TLS, headers, exposed services, known CVEs on visible software, default credentials and obvious misconfiguration
Server and stack hardening review when we host the target
Two-page executive summary, technical report with CVSS severity, evidence and fix steps per finding, and a Letter of Completion
One retest within 30 days, with a v2 report marking each finding fixed, open or accepted
Report within 5 business days of the test window; retest within 2 business days of your go-ahead

Penetration Test

One web application, its API (up to 50 endpoints) and the hosting infrastructure (up to 10 IPs or one cloud account configuration review). Manual, authenticated testing by a tester; tools only feed the manual work.

PTES, OWASP WSTG and API Security Top 10, with business-logic tests on login, sessions, checkout, coupons, payments, file upload and access control
Critical findings flagged within 24 hours of discovery, not held for the report
Everything in Tier 1, plus findings mapped to ISO 27001 Annex A, SOC 2 criteria and PCI DSS 11.4 where relevant, a signed Letter of Attestation and a 60-minute readout with the tester
Two retests within 60 days
Report within 10 business days of the test window; scheduled within two weeks of authorisation

Continuous Security

A yearly programme for up to four scopes, for example web application, API, cloud account and external network. Internal network up to 25 hosts optional.

A full penetration test at the start, then quarterly manual test cycles on what changed, or retests gated to major releases
Monthly external scans of every scope, with findings validated by an engineer
Three retests a quarter; critical findings flagged within 24 hours
Quarterly report and readout, monthly scan summary, an annual Letter of Attestation, a remediation roadmap kept current and an evidence folder your auditor can read
A scope owner on our operations desk for the year; billed quarterly in advance

Prices exclude applicable taxes. Indian invoices carry GST. Billed 50% on authorisation and 50% on report delivery; Continuous Security quarterly in advance. Quotes valid 30 days.

Common questions

What is VAPT?

VAPT means vulnerability assessment and penetration testing. The assessment finds security weaknesses in your web app, API and servers; the penetration test exploits them to prove the real impact, so you fix what matters first.

How much does VAPT cost in India?

A vulnerability assessment is ₹25,000. Manual penetration testing starts at ₹1,49,000 per engagement. Continuous Security starts at ₹3,50,000 a year. Prices exclude GST.

What is the difference between a vulnerability assessment and a penetration test?

An assessment scans your targets and we check every finding by hand. A penetration test is manual, logged-in testing of how your app can be abused. Banks, auditors and enterprise customers usually ask for the penetration test.

Does web application penetration testing include API security testing?

Yes. Our Penetration Test covers one web application, its API up to 50 endpoints, and the agreed hosting scope: 10 external IPs or one cloud account.

What does a VAPT report contain?

An executive summary, a severity rating and evidence for every finding, a specific fix, and a retest record marking each finding fixed, open or accepted. Penetration tests include a signed Letter of Attestation.

How long does a VAPT take?

An assessment report arrives within 5 business days of the test window. A penetration test is scheduled within two weeks and reported within 10 business days. Critical findings reach you within 24 hours.

Can I get a VAPT certificate?

Penetration tests include a signed Letter of Attestation. A CERT-In audit certificate is an optional add-on, issued by a CERT-In empanelled auditor.

Client voices

What clients say about our team.

I had an excellent experience using Zenocloud services.

IT services company Google review · 2026
Been working with ZenoCloud for over 3 years now and the experience has been fantastic.

Client for 3+ years Google review · 2026
Great experience with Zenocloud.

Hosting client Google review · 2026

Read our reviews on Google → (opens in a new tab)

Get started

Get your pentest scoped.

Tell us your scope and deadline. Testing is scheduled within two weeks.

Prefer to talk? Call India +91 99991 08033 or US +1 714 242 5683

VAPT services for software that keeps changing.

What is VAPT?

AI finds. People prove.

Vibe-coded apps need an audit.

See a sample VAPT report.

Customers can read and change other customers' orders

Review findings. Keep testing what changes.

Get a free exposure check.

Sell VAPT to your clients.

VAPT pricing.

Vulnerability Assessment

Penetration Test

Continuous Security

Vulnerability Assessment

Penetration Test

Continuous Security

What is VAPT?

How much does VAPT cost in India?

What is the difference between a vulnerability assessment and a penetration test?

Does web application penetration testing include API security testing?

What does a VAPT report contain?

How long does a VAPT take?

Can I get a VAPT certificate?

What clients say about our team.

Get your pentest scoped.

What should we quote?

Quote request received.