VAPT: Vulnerability Assessment and Penetration Testing Explained
VAPT is the combination of two distinct security testing activities. Vulnerability Assessment (VA) systematically identifies and prioritises known weaknesses in a system — typically using automated scanners augmented with manual review. Penetration Testing (PT) then takes those (and newly discovered) findings and attempts to exploit them under controlled conditions, demonstrating real-world business impact.
Treating VA and PT as a single service is a common commercial packaging in India in particular, but under the hood they answer different questions:
| Vulnerability Assessment | Penetration Testing | |
|---|---|---|
| Primary question | What weaknesses exist? | Can those weaknesses actually be used to compromise us? |
| Approach | Broad, scan-driven | Depth-focused, attacker-simulated |
| Typical output | Prioritised list of findings with CVSS scores | Chain-of-exploits narrative, business impact, remediation |
| Automation | Heavy (Nessus, Qualys, Nuclei, Burp active) | Light — a tester drives it |
Where VAPT Is Required
- PCI DSS: Requirement 11 mandates internal/external vulnerability scans quarterly and penetration tests at least annually.
- ISO 27001 (Annex A.12.6.1): Technical vulnerability management is a required control; VAPT is the usual evidence.
- RBI Cyber Security Framework: Banks must perform VAPT regularly; critical systems demand it before go-live and after major changes.
- SEBI CSCRF: Market intermediaries must have VAPT performed by a CERT-In empanelled auditor.
- UIDAI AUA/KUA, GIGW, MeitY empanelment: Various Indian government and regulated-entity requirements point to CERT-In empanelled VAPT.
CERT-In Empanelled VAPT
When an Indian regulator says "VAPT by a CERT-In empanelled auditor," it means the audit must be performed by one of the organisations on the official CERT-In empanelment list. Only reports from empanelled firms are accepted for the regulatory filings.
Typical VAPT Engagement
- Scoping: Define targets (web apps, APIs, mobile apps, network ranges, cloud accounts). Clarify grey-box vs. black-box, credentialed vs. non-credentialed.
- Reconnaissance and VA scan: Automated scanning plus manual enumeration.
- Exploitation (PT): Attempt to chain findings into meaningful compromise paths.
- Reporting: Executive summary, technical findings with CVSS, exploit chains, remediation guidance, and compliance mapping.
- Re-testing: Validate that fixes close the findings.