What a CERT-In Empanelled VAPT Actually Costs
VAPT pricing in India varies by scope more than any other variable. The following are 2026 benchmarks for engagements performed by CERT-In empanelled firms:
| Scope | Boutique | Mid-size empanelled firm | Big-four / major IT services |
|---|---|---|---|
| Single web app VAPT | ₹1.5L – ₹3L | ₹2.5L – ₹5L | ₹5L – ₹12L |
| Single mobile app (one platform) | ₹1.5L – ₹3L | ₹2.5L – ₹5L | ₹5L – ₹10L |
| API VAPT (10–30 endpoints) | ₹1L – ₹2.5L | ₹2L – ₹4L | ₹4L – ₹10L |
| External network VAPT (per /24) | ₹60k – ₹1.2L | ₹1L – ₹2L | ₹2L – ₹5L |
| SEBI CSCRF VAPT package | ₹5L – ₹10L | ₹8L – ₹15L | ₹15L – ₹30L+ |
Compressed scopes and non-regulated use cases can go lower. Over-scoped product audits can go much higher. Treat these as anchors, not absolutes.
Budget Tier Recommendations
Startup budget (under ₹3L): Single web or mobile app VAPT with a competent boutique empanelled firm. Scope aggressively (one app, credentialed grey-box, one re-test round). Many good boutiques will deliver a technically strong report at this price if you accept a 4–6 week lead time.
Mid-market (₹3L – ₹8L): Full product VAPT (web + mobile + APIs) with a mid-size empanelled firm. Add source-code review for the one or two most sensitive services. Include a formal pre-production and post-remediation test.
Enterprise / regulated (₹8L+): Multi-stream engagement with a major empanelled firm. Include red-team scenarios where the regulator or risk committee requires them. Expect a 3–4 month calendar from kickoff to re-test.
Where to Cut Costs
- Reduce the attack surface before you book testing. Pre-remediate obvious issues (missing security headers, outdated dependencies, debug endpoints exposed) so the testers spend their time finding the hard ones.
- Grey-box, credentialed, in staging. You get far more value per rupee than black-box or production-only testing.
- Scope one app, one platform at a time. Combined scopes attract bundle premiums but rarely deliver combined depth.
- Multi-year contracts for recurring audits. Firms will discount 10–20% for a 2–3 year commitment on annual VAPT.
- Rely on the auditor's standard methodology. Custom methodology adaptation and bespoke reporting formats add 15–30% to the price.
Where Not to Cut Costs
- Tester seniority. The engineer who finds a tenant isolation flaw and the engineer who runs a scanner cost similarly to procure but produce very different outputs. Insist on named profiles.
- Re-testing. Skipping re-test means your remediation work is unverified and your regulator will notice.
- Scope cuts that remove authentication flows. Auth is where the exploitable stuff lives in modern apps.
- CERT-In empanelment itself. If your audit is for a regulator, a non-empanelled firm's report won't be accepted. The "savings" are illusory.
Red Flags in Discount Quotes
- Fixed-price for a scope they haven't scoped. Serious firms ask questions before quoting.
- "Senior team" without named profiles. Means junior testers.
- No sample redacted report. Means the report is probably templated scanner output.
- Promised 2–3 day turnaround for a product VAPT. Means nobody actually tested anything.
How to Shortlist
Use the CERT-In empanelled directory filtered to VAPT-capable firms, then narrow by state. Three to five quotes is enough — focus on the proposed team's profiles and sample reports, not on the lowest number.