VAPT in India: A 2026 Buying Guide
VAPT — Vulnerability Assessment and Penetration Testing — is the most common security audit purchased in India. It's required by RBI for banks, by SEBI for market intermediaries, by UIDAI for Aadhaar-dependent systems, and by many enterprise procurement teams before onboarding a vendor. It's also one of the most variable services in cost and quality: identical scopes can quote anywhere from ₹1L to ₹20L depending on the firm.
This guide walks through how to scope, buy, and evaluate a VAPT in the Indian market in 2026.
When You Need a CERT-In Empanelled Firm
Short answer: when a regulator or government buyer says so.
| Context | Empanelled firm required? |
|---|---|
| RBI-regulated bank, NBFC, payment system operator | Yes |
| SEBI market intermediary (CSCRF VAPT) | Yes |
| IRDAI-regulated insurer | Yes (for insurer-side audits) |
| UIDAI AUA/KUA | Yes |
| MeitY empanelment or GIGW audit | Yes |
| SOC 2 or ISO 27001 vendor penetration test | No |
| Internal product security assurance | No |
If you need one, the CERT-In empanelled directory is where to start. Filter by VAPT capability to narrow to firms that have declared it.
Scoping Decisions That Drive 70% of the Price
Grey-box vs. black-box. Grey-box (tester receives valid user credentials, roles, and some documentation) finds significantly more and typically costs the same. Black-box only makes sense if you're specifically simulating an untrusted attacker.
Credentialed vs. non-credentialed. For web apps, APIs, and mobile — always credentialed. Non-credentialed VAPT on a modern authenticated app is close to useless.
Breadth: single app vs. environment. Scope creep is the #1 cost multiplier. Decide upfront whether this engagement is:
- Single app (one web app + its APIs) — simplest to price and bound.
- Product environment (web + mobile + APIs + their shared infra) — multi-stream, requires a defined RACI.
- Infrastructure/network VAPT — scoped by IP ranges and asset count.
- Red team / assumed-breach — distinct engagement; don't bundle this into a VAPT.
Re-testing. Confirm up front what re-testing is included. The standard is one round of re-testing within 30 days of final report; anything beyond that is paid.
Timeline Benchmarks
| Scope | Testing time | Report + re-test |
|---|---|---|
| Single web app | 5–10 business days | 1 week |
| Mobile app (one platform) | 5–8 business days | 1 week |
| API with 10–30 endpoints | 4–8 business days | 1 week |
| Full product (web + mobile + API) | 15–25 business days | 2 weeks |
| External network VAPT (per /24) | 2–5 business days | 1 week |
Add 1–2 weeks of lead time for kickoff and scoping. Expect to be in-engagement for 6–8 weeks total for a product-level audit.
Red Flags When Comparing Proposals
- Nessus/Qualys scan output presented as "penetration testing" — that's VA, not PT. If the deliverable preview is a scanner PDF, keep looking.
- No named testers or vague "senior team" language — insist on individual profiles with certifications and prior engagements.
- Fixed-price for a scope they haven't scoped — a serious firm asks structured questions before quoting.
- No sample report — reputable firms share redacted samples. The report is the deliverable; see one.
- Over-reliance on CVSS counts — "we found 47 high-severity issues" without exploit narrative is weak. Depth matters more than count.
What a Good Report Looks Like
- Executive summary that a non-technical reader can act on. Business risk, not CVE lists.
- Narrative exploit chains that demonstrate real-world impact — "unauthenticated access → tenant privilege escalation → PII export."
- Remediation specifics keyed to your tech stack, not generic ("fix SQL injection" vs. "parameterise the query at
OrderRepo.findByFilter"). - Compliance mapping when the audit maps to a framework (PCI, ISO 27001, RBI, SEBI CSCRF).
- Reproducible evidence — payloads, requests/responses, screenshots.
Pricing in Context
A proposal that comes in dramatically below the market usually has one of three issues: (a) the team is junior, (b) the scope is being interpreted narrowly, or (c) the testing time is dramatically compressed. The failure mode is a shallow report that passes the regulator but misses what will actually break your product. The firm's incentive is to meet the scope on paper — your incentive is to actually surface problems.
Expect to pay market rates for a serious engagement:
- Boutique specialist: ₹1.5L–₹5L for a single web app VAPT. Fastest to engage, often best technically.
- Mid-size CERT-In empanelled firm: ₹2.5L–₹8L. Good process maturity for regulated contexts.
- Big-four / major IT services VAPT practice: ₹5L–₹20L+. Procurement-friendly, slower.
Shortlist From the Directory
Use the CERT-In empanelled directory to filter:
- Capability: VAPT, plus any domain-specific capability (API, mobile, cloud, SWIFT, ICS/OT).
- State: for in-person kickoffs if that matters.
- Request a quote on the firm's detail page.