VAPT in Plain English
Vulnerability Assessment and Penetration Testing (VAPT) is a two-phase security audit that finds weaknesses in your digital infrastructure before attackers do. Think of it as a health check-up for your website, APIs, and servers.
1,39,000+Cyber incidents handled by CERT-In in 2025 (CERT-In Annual Report 2025)
₹17.6 CrAverage cost of a data breach in India (IBM Cost of a Data Breach 2025)
MostIndian businesses run zero security audits — web apps and APIs go untested until a breach forces the issue
6 hrsCERT-In mandatory breach reporting window (CERT-In Direction 2022)
INFO
VAPT is not a luxury for large enterprises. Under the DPDP Act 2023, every organisation processing personal data must implement "reasonable security safeguards" — and VAPT is the industry-standard way to demonstrate you've done that.
The Two Phases Explained
graph LR
A[🌐 Your Infrastructure] --> B[Phase 1:
Vulnerability Assessment] B --> C[Phase 2:
Penetration Testing] C --> D[📊 Risk Report
+ Fix Plan] style A fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style B fill:#1e3a5f,stroke:#F97316,color:#e2e8f0 style C fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style D fill:#1e5f3a,stroke:#10B981,color:#e2e8f0
Vulnerability Assessment] B --> C[Phase 2:
Penetration Testing] C --> D[📊 Risk Report
+ Fix Plan] style A fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style B fill:#1e3a5f,stroke:#F97316,color:#e2e8f0 style C fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style D fill:#1e5f3a,stroke:#10B981,color:#e2e8f0
Phase 1: Vulnerability Assessment (VA)
Automated scanning that identifies known weaknesses:
- Open ports and exposed services
- Outdated software with known CVEs
- Missing security headers (CSP, HSTS, X-Frame-Options)
- Weak TLS/SSL configurations
- Default credentials and exposed admin panels
- DNS misconfigurations
Phase 2: Penetration Testing (PT)
Manual and semi-automated testing that attempts to exploit the vulnerabilities found:
- SQL injection, XSS, CSRF attempts
- Authentication bypass testing
- Business logic flaws
- API abuse scenarios
- Privilege escalation
- Data exfiltration paths
What Does a VAPT Report Look Like?
A professional VAPT report ranks every finding by severity:
| Severity | What It Means | Example | Fix Timeline |
|---|---|---|---|
| Critical | Immediate exploitation risk | SQL injection on login page | 24 hours |
| High | Exploitable with moderate effort | Broken access controls | 72 hours |
| Medium | Requires specific conditions | Missing rate limiting | 1-2 weeks |
| Low | Informational / minor risk | Server version disclosure | 1 month |
| Info | Best practice recommendation | Missing HSTS header | Next sprint |
Key Takeaway
A good VAPT report doesn't just list problems — it tells you exactly how to fix each one, in priority order. Bachao.AI reports include code-level remediation steps, not just generic advice.
Know your vulnerabilities before attackers do
Run a free VAPT scan — takes 5 minutes, no signup required.
Book Your Free ScanWhy Indian Businesses Specifically Need VAPT in 2026
1. Regulatory mandates are now enforceable
Aug 2023DPDP Act passed — "reasonable security safeguards" required
Apr 2024CERT-In mandates 6-hour breach reporting
Jan 2025RBI master direction on IT governance for regulated entities
Jan 2026DPDP Act full enforcement — penalties up to ₹250 Cr active
Apr 2026SEBI CSCRF compliance deadline for market intermediaries
2. India-targeted attacks are surging
graph TD
A[🤖 Automated Bot Scans
Millions per day] -->|Find Indian IP ranges| B[🎯 Target Selection
Small businesses preferred] B -->|Weak security = easy target| C[💣 Exploitation
Known CVEs, default creds] C --> D[📁 Data Theft
Customer PII, payment data] C --> E[🔐 Ransomware
Average demand: ₹45 lakh] D --> F[💀 Dark Web Sale
Indian data premium: 2x] style A fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style E fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style F fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0
Millions per day] -->|Find Indian IP ranges| B[🎯 Target Selection
Small businesses preferred] B -->|Weak security = easy target| C[💣 Exploitation
Known CVEs, default creds] C --> D[📁 Data Theft
Customer PII, payment data] C --> E[🔐 Ransomware
Average demand: ₹45 lakh] D --> F[💀 Dark Web Sale
Indian data premium: 2x] style A fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style E fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style F fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0
3. Customer and investor expectations
Enterprise clients now require VAPT certificates from vendors before signing contracts. If you sell B2B, a clean VAPT report is becoming as essential as GST registration.
Types of VAPT
| Type | What's Tested | Best For | Frequency |
|---|---|---|---|
| Network VAPT | Firewalls, servers, internal network | Offices with on-premise infra | Quarterly |
| Web Application VAPT | Websites, web apps, portals | SaaS companies, e-commerce | After every major release |
| API VAPT | REST/GraphQL endpoints | Fintech, healthtech, platforms | Quarterly |
| Mobile App VAPT | iOS/Android apps | Consumer-facing apps | After every release |
| Cloud VAPT | AWS/Azure/GCP configuration | Cloud-native businesses | Quarterly |
How Much Does VAPT Cost?
The Indian market has historically overcharged businesses for VAPT:
| Provider Type | Typical Cost | Timeline | What You Get |
|---|---|---|---|
| Big 4 consulting firms | ₹5-15 lakh | 4-6 weeks | Enterprise-grade, overkill for most businesses |
| Mid-tier security firms | ₹1-5 lakh | 2-4 weeks | Good quality, but expensive for startups |
| Freelance pentesters | ₹30K-1 lakh | 1-2 weeks | Variable quality, no compliance mapping |
| Bachao.AI | Free scan | < 24 hours | Automated scan + risk score + top findings |
| Bachao.AI Full Report | Scope-based | 2-3 days | Deep scan + DPDP mapping + code fixes |
TIP
Start with a free scan to understand your risk posture. You can always upgrade to a detailed report if you need compliance documentation or remediation guidance.
Getting Started with Your First VAPT
- Run a free scan — Visit bachao.ai and enter your domain
- Review your risk score — Understand where you stand on a 0-100 scale
- Fix critical issues first — Address anything rated Critical or High immediately
- Schedule regular scans — Quarterly at minimum, after every major release ideally
- Document everything — Keep VAPT reports for compliance audits
INFO
5 minutes to your first security assessment. No signup required, no credit card needed. Visit bachao.ai and see your risk score today.
Written by Shouvik Mukherjee, Founder of Bachao.AI. 15+ years in software engineering, now building AI-powered security products for Indian businesses. DPIIT Recognised Startup. Follow me on LinkedIn for cybersecurity insights.
