On this page
VAPT in one sentence
Vulnerability assessment and penetration testing (VAPT) is a security test in which an expert maps your systems, finds weaknesses and then tries to exploit them the way a real attacker would, before writing up what they reached and how to fix it. For the basics, see what a VAPT assessment is.
The components of a VAPT engagement
- Scoping and NDA. An NDA is signed before any technical detail is shared. Then the scope is fixed: which applications, APIs, mobile apps, networks or cloud accounts, which environments, which user roles and tenants, and any rules of engagement such as testing windows.
- Reconnaissance and attack-surface mapping. The tester discovers every reachable host, subdomain, endpoint and parameter, including old API versions and forgotten admin pages.
- Vulnerability assessment (the VA). Automated and manual checks for known weaknesses: outdated components, misconfigurations, weak TLS, exposed services and missing security headers. This is broad coverage, not proof.
- Penetration testing (the PT). The expert work. Authentication, session handling, access control between roles and tenants, business logic, injection and API authorisation are tested by hand, and small issues are chained into real attacks. Our types of penetration testing guide covers black, grey and white box.
- Risk rating. Each confirmed finding is scored, usually with CVSS, and adjusted for real business impact: whose data, which function, how hard to exploit.
- Reporting. An executive summary for leadership, detailed findings with evidence and stack-specific fixes for engineering, and the scope and method an auditor needs. See a sample VAPT report, section by section.
- Remediation support and retest. Your team fixes the findings with the tester on hand for questions, then each fix is tested again and the report is updated to show what is closed.
VA vs PT: what each part gives you
- Vulnerability assessment
- Wide coverage of known issues, mostly tool-assisted. Tells you what might be wrong.
- Penetration test
- Manual exploitation by an expert. Proves what an attacker can reach and finds logic and access-control flaws tools miss.
- Together
- Breadth from the assessment, depth and proof from the test, in one report your auditor and customers accept.
Scanner-level checks are the part you should not pay much for. Sumrite’s free scan at scan.sumrite.com covers them, so the paid engagement is spent on the manual testing. More in VAPT vs vulnerability scan.
What can be in scope
Web applications
Every role and tenant, authentication, business logic and the OWASP Top 10. See the web application VAPT guide.
APIs
Object and function level authorisation, tokens, rate limits and undocumented endpoints, mapped to the OWASP API Top 10.
Mobile apps
Android and iOS builds, local storage, certificate pinning and the APIs behind the app, tested against OWASP MASVS.
Networks and cloud
External and internal hosts, Active Directory, and AWS, Azure or GCP configuration and identity.
What to check in a VAPT quote
- Manual penetration testing is included, not only automated scanning
- Every user role and tenant to be tested is listed in the scope
- The report includes evidence and stack-specific remediation for each finding
- A retest of fixed findings is included in the price
- Findings are mapped to the frameworks your auditor or customer uses
- An NDA is signed before you share anything technical
Pricing depends on scope; our VAPT cost guide explains what moves it, and how long a penetration test takes covers timing.
See what a finished VAPT looks like
Watch the short walkthrough on the sample VAPT report page, or get a quote for your scope.
Frequently asked questions
What does a VAPT comprise?
A VAPT comprises scoping and an NDA, a vulnerability assessment that maps the attack surface and known weaknesses, manual penetration testing that tries to exploit them, risk rating of each finding, a report with evidence and fixes, remediation support, and a retest that confirms the fixes work.
What is the difference between the VA and the PT in VAPT?
The vulnerability assessment finds and lists possible weaknesses, largely with tools. The penetration test is the manual part, where an expert tries to exploit them, chains them together and proves what an attacker could actually reach.
What are the deliverables of a VAPT?
An executive summary, a detailed technical report with each finding's severity, evidence and remediation, a remediation tracker, and a retest report or letter showing which findings are closed. Sumrite also maps findings to the compliance frameworks you are working towards.
What can be in scope for a VAPT?
Web applications, APIs, mobile apps, internal and external networks, cloud accounts, thick-client applications and source code. Each needs its own approach, so the scope lists every asset, environment and user role to be tested.
Is a retest part of a VAPT?
It should be. Without a retest you only know what was wrong, not that it is fixed. Sumrite includes a retest of fixed findings in standard engagements.
Faisal Khan is a Director at Sumrite, where he oversees penetration testing, risk assessment and compliance engagements for SaaS and enterprise clients. Case studies are anonymised and published with client permission.
