VAPT pairs a broad sweep for known flaws with a deep attempt to exploit them.

The vulnerability assessment half uses scanners and manual checks to list weaknesses across many assets. The penetration testing half picks the promising ones and tries to use them, showing what an attacker could reach. Together they give breadth and depth in one report.

Spelled out: Vulnerability Assessment and Penetration Testing.

The term is widely used in India, in tenders, regulator circulars and customer contracts. A buyer who asks for a "VAPT report" usually wants both halves; a scan export alone will not satisfy them. Some buyers, often in government and regulated sectors, also ask that the tester be on CERT-In's empanelled list of auditing organisations. There is no standard "VAPT certificate": what you receive is a report, and sometimes a short letter summarising scope, dates and status, which you can share where the full report is too sensitive.

Tenders and vendor onboarding forms

A requirement to submit a recent VAPT report for the application or infrastructure in scope.

Regulated-sector directions

Banking, securities and insurance regulators in India expect periodic testing of systems; the instrument decides frequency and form.

SOC 2 and ISO 27001 programmes

VAPT reports used as evidence for vulnerability management and system monitoring controls.

Vulnerability scan

An automated check only. It is an input to the assessment half of VAPT, not the whole of it.

Penetration testing

The exploitation half alone. Many testers include an assessment step anyway; VAPT makes both explicit.

Security audit

A review of policies, processes and controls against a standard. VAPT tests technical exposure directly.

• Ask the buyer what they need: scope, frequency, whether a CERT-In empanelled tester is required, and whether a summary letter will do.
• List the assets in scope: web apps, APIs, mobile apps, external IPs, internal networks, cloud configuration.
• Agree rules of engagement, then plan remediation and a retest.
• Keep each report with its retest result and the date, since buyers ask how recent it is.

• GuideSecurity testing servicesVulnerability assessment and penetration testing, scoped to what your buyers and auditors ask for.
• GuideWeb application security testingManual and tool-assisted testing of web apps and APIs.
• GuideTechnical vulnerability managementFinding, ranking and fixing weaknesses on a schedule.

Sources: NIST SP 800-115, Technical Guide to Information Security Testing and Assessment; CERT-In public pages on empanelled information security auditing organisations; OWASP Web Security Testing Guide.