How to Read a VAPT Report: Guide for Indian Founders and Boards

A VAPT report (Vulnerability Assessment and Penetration Testing report) is a structured document that tells you what weaknesses exist in your systems, how severe they are, and what to do about them. For Indian founders and boards, reading one is not a technical exercise — it is a governance and risk decision. The executive summary gives you the headline risk score; the findings section lists each vulnerability with its CVSS severity rating; the remediation section tells your team how to fix each issue; and the retest section confirms fixes were applied. This guide walks you through every section so you can ask the right questions and make the right calls.

What Is Inside a VAPT Report

A professional VAPT report delivered by a security firm — including those working with a CERT-In empanelled partner — follows a consistent structure. Understanding each section helps you act faster and ask sharper questions.

Executive Summary

The first two pages are written for you, not your CTO. They capture:

1. Overall risk rating — typically a single score (Critical / High / Medium / Low) or a numerical CVSS aggregate.
2. Scope — what systems, URLs, IPs, or applications were tested.
3. Test window — the dates testing was conducted. A gap between report date and test date matters.
4. Key findings count — a breakdown of how many Critical, High, Medium, and Low issues were found.
5. Top risks in plain English — a few sentences describing the most dangerous issues without jargon.

Risk Score and CVSS

Every finding is assigned a severity using the Common Vulnerability Scoring System (CVSS), the global standard maintained by FIRST (Forum of Incident Response and Security Teams) at first.org/cvss. CVSS v3.1 scores range from 0.0 to 10.0 and map to severity bands:

The Findings Section

Each finding in a professional report contains:

1. Finding ID — a reference number for tracking.
2. Title — a short description (e.g., "SQL Injection on Login Endpoint").
3. Severity — Critical / High / Medium / Low / Informational.
4. CVSS Score — the numeric score with the vector string.
5. Description — what the vulnerability is.
6. Impact — what an attacker can do if they exploit it.
7. Evidence — screenshots, payloads, or request/response logs showing the issue is real.
8. Remediation — specific steps to fix it.
9. References — links to CVE entries, OWASP categories, or vendor advisories.

Remediation and Retest

The remediation section is where the report becomes actionable. Each finding should have:

1. Fix guidance — specific code or configuration changes, not generic advice like "update your software."
2. Effort estimate — optional but useful for prioritization.
3. Retest confirmation — after your team applies fixes, a responsible vendor will retest to confirm closure.

How to Interpret Severity for Business Decisions

The severity bands tell you urgency, not just technical impact. Here is how to translate them into business action:

graph TD
    A[Finding Identified in VAPT Report] --> B{What is the Severity?}
    B --> C[Critical or High]
    B --> D[Medium]
    B --> E[Low or Informational]
    C --> F{Is it internet-facing or affects customer data?}
    F --> G[YES - Fix within 24 to 72 hours]:::danger
    F --> H[NO - Fix within 1 week and monitor]:::danger
    D --> I{Does it chain with a Critical or High finding?}
    I --> J[YES - Escalate priority]:::danger
    I --> K[NO - Schedule in next sprint]:::normal
    E --> L[Add to maintenance backlog]:::normal
    G --> M[Retest and close ticket]:::success
    H --> M
    J --> M
    K --> M
    L --> M

    classDef danger fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0
    classDef normal fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0
    classDef success fill:#1e3d2f,stroke:#10B981,color:#e2e8f0

Typical Finding Distribution

Real-world VAPT reports on Indian web applications tend to cluster findings in a characteristic pattern. The chart below reflects typical distributions seen across assessments of SME and startup applications:

pie title Typical VAPT Finding Distribution by Severity
    "Low" : 45
    "Medium" : 30
    "High" : 18
    "Critical" : 7

Questions to Ask Your Security Team

When your CTO or security lead presents the VAPT report to you, here are specific questions that reveal whether the situation is under control:

On scope:

1. Was the test black-box (no credentials), grey-box (limited credentials), or white-box (full access)? Grey-box tests of authenticated APIs reveal more business-logic bugs than unauthenticated scans.
2. Were all production systems in scope, or only a subset? What was excluded and why?

1. Has each Critical or High been manually verified with a working exploit, or is it from an automated scan?
2. What is the earliest a patch can be deployed for the top three findings?
3. Is there a temporary compensating control (WAF rule, IP allowlist, rate limit) that can reduce exposure while the fix is developed?

1. Can you show me the actual HTTP request and response that demonstrates this vulnerability?

1. Is the fix a one-line config change or a code rewrite?
2. Who owns each finding — frontend, backend, DevOps, or a third-party vendor?

1. When is retest scheduled, and who signs off on closure?

What "False Positive" and "Accepted Risk" Mean

False Positive

A false positive is a finding that the scanner flagged but that does not actually exist in your system. Automated tools generate false positives regularly — a scanner might flag a login endpoint as vulnerable to SQL injection because the response time varied, when in reality your application uses parameterized queries throughout.

False positives inflate your finding count and can make a clean system look risky. A professional penetration tester manually eliminates false positives before delivering the report. If your vendor's report has more than 20% of findings marked as informational or false positive without evidence, push back.

Accepted Risk

An accepted risk is a real vulnerability that your organization has decided not to fix — typically because the cost or disruption of fixing it outweighs the likelihood and impact of exploitation. This is a legitimate business decision, but it must be documented formally.

Accepted risk documentation should include:

1. The finding ID and severity.
2. The business reason for accepting it.
3. The owner (name and role) who approved the decision.
4. A review date (typically 6 or 12 months).
5. Any compensating controls in place.

How VAPT Reports Support Governance

DPDP Act 2023 Compliance

India's Digital Personal Data Protection Act 2023 (governed by MeitY) places obligations on Data Fiduciaries to implement reasonable security safeguards to protect personal data. While the Act does not prescribe specific technical controls, regulators interpreting "reasonable security" will look for documented evidence of security testing and remediation. A dated VAPT report with a retest confirmation is exactly that evidence.

CERT-In Compliance

CERT-In (the Indian Computer Emergency Response Team under MeitY) mandates that organizations in certain sectors report cyber incidents within six hours and maintain security audit records. For organizations seeking formal CERT-In empanelled VAPT, the audit must be conducted by a CERT-In empanelled security auditor. If your current vendor is not empanelled, ask them to deliver the assessment with a CERT-In empanelled partner to ensure the report meets regulatory requirements.

Board Reporting

A VAPT report presented to a board should surface three things:

1. Current risk posture — how many Critical and High findings were open at the time of the report.
2. Trend — are findings increasing or decreasing since the last assessment?
3. Remediation velocity — what percentage of findings from prior assessments were closed before this one?

Running Your First VAPT

If your organization has not yet conducted a formal VAPT assessment, the first step is a baseline scan to understand your current exposure. Bachao.AI, built by Dhisattva AI Pvt Ltd, provides a free VAPT scan that gives you an initial risk score and findings summary — useful as a starting point before commissioning a full assessment with a CERT-In empanelled partner.

Browse the Bachao.AI blog for more guidance on security testing, DPDP compliance, and incident response for Indian businesses.