VAPT Cost in India: Why Quotes Differ and How to Compare

Quick answer: VAPT cost in India depends on what is tested (web app, API, mobile app, network, cloud), how many applications, IPs or roles are in scope, testing depth, whether a retest is included, the report format you need, and whether the auditor must be CERT-In empanelled. Define scope in writing first, then compare quotes line by line.

You ask three firms for a VAPT quote and get three very different numbers. One is so cheap it looks too good to be true, one feels expensive, and nobody explains what is actually being tested. Choose wrong and you either pay for a scanner report with a nice cover page, or for testing you did not need.

A VAPT (Vulnerability Assessment and Penetration Testing) is only useful if it tests the right things in enough depth. The price follows from that scope. This guide explains what drives VAPT cost in India, what a fair quote should include, and how to get quotes you can compare. It does not list prices, because the same label can mean very different work.

What a VAPT Actually Includes

A vulnerability assessment finds known weaknesses, usually with automated scanners plus manual review. A penetration test goes further: a tester tries to exploit those weaknesses, chain them together and reach data or systems, the way an attacker would. A good VAPT combines both and ends with a report that explains each finding, its risk and how to fix it. Our guide to VAPT services and what a security test covers explains the process in more detail.

Price differences usually come from how much manual testing is done. Automated scanning is quick and cheap. Manual testing of business logic, access control and authentication takes skilled time, and that is where most real issues are found.

Why VAPT Quotes in India Vary So Much

• Different scope assumptions. One firm counts a portal as one application. Another counts each user role, API and admin panel separately.
• Automated vs manual depth. A scan-only test costs far less than a manual test of every role and workflow, but finds far less.
• Retest left out. Some quotes include one retest after you fix the issues. Others charge it separately.
• Report type. A technical report is different from a compliance report or certificate needed for a regulator, client or government portal.
• Auditor status. Some buyers need a CERT-In empanelled auditor. Others do not.

Each of these is a fair reason for a different price. The problem is only when the quote does not say which one applies.

The Main Drivers of VAPT Cost in India

Cost driver	What increases effort	What to tell the vendor
Scope type	Web app, API, Android, iOS, network, cloud and thick client each need different skills	Exactly which types are in scope
Size of each target	Many pages, forms, user roles, API endpoints or modules	Number of roles, endpoints and main workflows
Number of IPs or hosts	Large internal and external IP ranges	Count of live IPs, servers and network devices
Testing approach	Grey-box or white-box testing with credentials and code access	Black, grey or white box, and test accounts provided
Environment	Testing in production with strict time windows	Whether a staging copy is available
Retest	Several rounds of fixes and verification	How many retests are included and within what period
Report and certificate	Compliance mapping, management summary, safe-to-host or audit certificate	Who will read the report and what they require
Auditor type	CERT-In empanelled auditor required by a regulator, client or department	Whether empanelment is mandatory for you
Location and timing	On-site internal testing, weekend or night windows	Remote or on-site, and allowed testing hours

Cost by Type of Test

Web application VAPT

Effort depends on the number of user roles, forms, payment or file upload features and admin panels. A simple brochure website takes little time. A citizen portal or ERP with many roles and workflows takes much longer.

API VAPT

Effort depends on the number of endpoints, authentication methods and how much documentation you provide. Good API documentation and test tokens reduce time.

Mobile app VAPT

Android and iOS are usually tested separately, along with the APIs the app calls. Local data storage, certificate pinning and code protection add checks.

Network VAPT

Driven by the number of live IPs, external versus internal testing, firewalls, VPNs and wireless networks. Internal testing may need someone on site.

Cloud configuration review

Driven by the number of accounts, services and regions. It checks identity and access, storage exposure, logging and network rules.

When You Need a CERT-In Empanelled Auditor

CERT-In maintains a list of empanelled information security auditing organisations. Government departments, PSUs and many regulated entities are asked to use empanelled auditors for certain audits, and some clients write it into contracts. If your requirement comes from a department, regulator or client, read the exact wording before you ask for quotes, because empanelled audits can involve more formal reporting. Our guide on CERT-In empanelled security audits explains the process. If empanelment is not required, you can choose any competent tester, but still check their experience and sample reports.

The Fix: How to Get VAPT Quotes You Can Compare

1. List every target. Write down each website, web app, API, mobile app, IP range and cloud account, with its URL or identifier.
2. Describe each target's size. Give the number of user roles, main workflows, API endpoints and live IPs.
3. Decide the approach. Choose black, grey or white box, and arrange test accounts for every role.
4. State why you need the test. Name the regulator, client or internal policy, and whether a CERT-In empanelled auditor is required.
5. Ask for the method in writing. Ask how much is manual testing, which standards are followed, such as the OWASP testing guides, and what tools are used.
6. Ask for a sample report. Check that findings have clear risk ratings, proof and practical fix steps, not just scanner output.
7. Confirm retest terms. Agree how many retests are included and the time window for fixes.
8. Compare line by line. Put each quote against the same scope and check what each one leaves out.

For a wider view on testing scope, see our article on how to scope penetration testing services.

What a Good VAPT Report Should Contain

The report is what you pay for. A good one lets your management understand the risk and lets your developers fix each issue without guessing. Check that a sample report includes:

• An executive summary in plain language, with the overall risk level and the most urgent issues.
• Scope and method, listing every target tested, the dates, the approach and the standards followed.
• Each finding with evidence, such as the affected URL or host, the steps to reproduce it and a screenshot or request sample.
• A risk rating for each finding, explained in terms of business impact, not just a score.
• Clear fix guidance that a developer or system administrator can act on.
• Retest results showing which findings are closed, which remain open and why.

If a sample report is mostly pages of scanner output with no proof or business context, expect the same quality for your own test, whatever the price.

How to Plan the Test Without Disrupting Work

A VAPT on live systems needs some preparation on your side. Share a contact person who can respond during testing, and agree the testing window, especially for systems used by citizens or customers. Take a fresh backup before testing begins and tell your hosting provider or security team, so the test traffic is not mistaken for a real attack. Where possible, test on a staging copy that matches production, and keep production testing for checks that need it. These steps reduce risk and often reduce cost, because testers lose less time waiting for access or recovering from blocked accounts.

Hidden Costs and Common Mistakes

• Fixing takes time too. Your developers or vendor must fix the findings. Budget their time, not just the tester's.
• Testing only once a year. Major releases and new integrations bring new risk. Plan testing after significant changes.
• Scanner-only reports. A cheap automated scan may miss logic flaws such as one user seeing another user's data.
• No production safeguards. Agree testing windows, backups and contacts before testing live systems.
• No protection between tests. A web application firewall and regular patching reduce risk while fixes are in progress.

Frequently Asked Questions

What decides VAPT cost in India?

Mainly the scope type, the size of each target, the number of IPs or roles, the testing approach, retest terms, the report format and whether a CERT-In empanelled auditor is required. Manual testing depth is the biggest single factor.

Why are some VAPT quotes very cheap?

Often because they rely mostly on automated scanning, exclude retests or count a large system as one small target. Ask how much manual testing is included and request a sample report.

Is a CERT-In empanelled auditor mandatory?

Only when a department, regulator, client or policy requires it. Check the exact requirement in your notice or contract, and confirm with your compliance adviser if unsure.

How often should we do VAPT?

At least once a year for important systems, and after major changes such as a new module, a new integration or a platform upgrade. Some regulators and clients set their own frequency.

Does VAPT cost include fixing the vulnerabilities?

Usually not. The tester finds and reports the issues and verifies the fixes in a retest. Your development team or vendor fixes them, so include that effort in your budget.

How Affix Center Can Help

Affix Center offers VAPT services in Mumbai for web applications, APIs, mobile apps, networks and cloud setups, with a written scope before any quote, manual testing and a clear report with fix steps. Our cyber security team can also help your developers close the findings. Contact us to scope your test.