VAPT Services in Mumbai: Why Cheap Scans Leave Gaps

Quick answer: Good VAPT services in Mumbai combine an automated vulnerability scan with manual penetration testing of your websites, APIs, mobile apps, network and cloud. Look for clear scoping, written rules of engagement, evidence for every finding, business-focused risk ratings, practical fixes and a free or agreed retest to confirm the issues are closed.

Many organisations buy a security test because a regulator, auditor or large customer asked for one. The report arrives, a few findings get fixed, and the file goes into a folder until next year. Then a real attacker finds the issue the test never looked at, because what was sold as a penetration test was only an automated scan with a new cover page.

Businesses searching for VAPT services in Mumbai quickly find that two reports with the same title can differ enormously in depth. This guide explains what a good VAPT engagement covers, how the main test types compare, how to prepare, and how to judge the report so the money spent actually reduces risk.

What VAPT Actually Means

Vulnerability Assessment and Penetration Testing (VAPT) combines two different activities:

• Vulnerability assessment: a broad, largely tool-driven sweep that identifies known weaknesses such as missing patches, outdated software, weak configurations and exposed services. It answers the question "what might be wrong?"
• Penetration testing: a manual, skilled attempt to exploit those weaknesses and chain them together, the way a real attacker would. It answers the question "what can an attacker actually do?"

A scan alone produces long lists of issues, many of them low risk or false positives. A penetration test shows which issues matter, for example that a misconfigured web server plus a reused password leads to your customer database. Good VAPT uses both. Our guide to cyber security testing services explains how VAPT fits alongside other tests such as red teaming and configuration reviews.

Scan vs VAPT vs Full Penetration Test

Type	What you get	Good for	What it misses
Automated vulnerability scan	Tool output listing known issues and missing patches	Frequent hygiene checks between deeper tests	Business logic flaws, chained attacks, false positive filtering
VAPT (scan plus manual testing)	Verified findings with evidence, risk ratings and fixes	Yearly or pre-launch assurance for apps, networks and cloud	Depends on scope; anything left out of scope is not tested
Deep penetration test or red team	Goal-based attack simulation across people, process and technology	Mature organisations testing detection and response	Not a full list of every weakness, more time and cost
Free online website checker	Quick view of headers, SSL and obvious exposures	A first look at a public website	Almost everything behind login, APIs and internal systems

As our article on what a website security checker misses explains, a clean quick scan is not proof that an application is safe.

What a Good VAPT Engagement Covers

Scope depends on your environment and risk, but a complete programme usually includes some or all of the following.

External network and perimeter

Internet-facing IP addresses, firewalls, VPN gateways, mail servers and remote access services. Testers look for open ports, outdated services, weak encryption and exposed admin panels.

Web applications and APIs

Customer portals, e-commerce sites, internal web apps and the APIs behind mobile apps. Testing should cover the OWASP Top 10 categories, such as broken access control, injection and authentication flaws, plus business logic issues that tools cannot find, like changing an order amount or viewing another user's records.

Mobile applications

Android and iOS apps, including insecure data storage on the device, hard-coded keys, weak certificate validation and the security of the APIs the app calls.

Internal network

What an attacker or a malicious insider could do once inside the office network: Active Directory weaknesses, unpatched servers, shared credentials and flat networks with no segmentation.

Cloud configuration

Storage buckets, identity and access policies, security groups and logging on cloud platforms. Misconfiguration is a frequent cause of cloud data exposure.

Wireless and physical access

Guest Wi-Fi isolation, rogue access points and whether network ports in meeting rooms give direct access to internal systems.

The Fix: How to Scope, Run and Close a VAPT

Poor scoping is the most common reason a VAPT misses serious issues. Follow these steps from planning to closure.

1. List your assets: domains, IP ranges, applications, APIs, cloud accounts and critical servers. Many organisations find forgotten systems during this step alone.
2. Rank by risk: systems that hold personal data, payment data or that are exposed to the internet come first.
3. Choose the testing approach: black box (no information shared), grey box (test user accounts and some documentation) or white box (full access, including source code). Grey box usually gives the best value for time spent.
4. Agree rules of engagement: testing windows, systems that must not be disrupted, contact persons and what testers should do if they find a critical issue mid-test.
5. Get written authorisation: from the system owner, and from your hosting or cloud provider where their terms require it.
6. Prepare a safe environment: for high-risk tests on production-critical applications, a staging copy with realistic data is safer.
7. Fix by risk and owner: give every finding an owner and a target date, and close critical and high issues on internet-facing systems first.
8. Retest and record closure: ask the tester to verify fixes and issue a closure note, which auditors and customers often ask for.

How to Judge a VAPT Report

The report is what you pay for. A useful report contains:

• An executive summary in plain language for management, stating overall risk and the most urgent issues.
• Clear methodology: what was tested, how, from where and on which dates.
• Findings with evidence: each issue with its location, proof such as screenshots or request and response logs, and steps to reproduce it.
• Risk ratings that consider both technical severity and business impact, not just a tool score.
• Practical remediation guidance specific to your technology, not generic text copied from a database.
• Attack narratives showing how individual weaknesses were combined.

Warning signs include hundreds of pages of raw scanner output, no manual findings, identical text across unrelated issues and no evidence of exploitation attempts.

Questions to ask before you sign

• How many days of manual testing are planned for each application, and who will do it?
• Which tools will you use, and how do you confirm that tool findings are real?
• Will you test business logic, such as one user viewing another user's data?
• How will you report a critical issue found halfway through the test?
• What exactly does the retest include, and how long after the report can we ask for it?

Clear, specific answers to these questions are a good sign. Vague answers, or a price far below others for the same scope, usually mean less manual work.

Choosing a VAPT Provider in Mumbai

Being close by helps with on-site internal network and wireless tests, and with workshops to walk teams through findings. Beyond location, check:

• Whether you need a CERT-In empanelled auditing organisation. Some departments and regulators ask for this, so confirm the requirement before you issue a work order. Our note on CERT-In empanelled security audits explains when it applies.
• Sample reports with sensitive data removed, to see the depth of manual testing.
• Who will actually test, and whether any part is subcontracted.
• Whether retesting is included and within what time frame.
• How findings are handed over to developers and IT, and whether the provider can help with fixes such as patch management and configuration changes.

Plan VAPT at least once a year and after major changes such as a new application release, a cloud migration or a network redesign.

Frequently Asked Questions

What is the difference between vulnerability assessment and penetration testing?

A vulnerability assessment finds and lists known weaknesses, mostly with tools. A penetration test manually tries to exploit them and chain them together to show real impact. VAPT combines both.

How often should a business in Mumbai get a VAPT done?

At least once a year for important systems, and after major changes such as new applications, big releases, cloud migrations or network redesigns. Some regulators and customers set their own frequency, so check those requirements too.

Is a CERT-In empanelled auditor required for VAPT?

Not always. Some government departments, regulators and contracts require it, while many private businesses can choose any qualified tester. Confirm the requirement in your tender, contract or regulatory guidance before you choose.

Will VAPT disrupt our live systems?

It should not, if rules of engagement are agreed in advance. Testing windows, excluded systems and stop conditions should be written down, and high-risk tests can run on a staging copy.

What should we do after receiving the VAPT report?

Assign owners and target dates to each finding, fix critical and high issues first, then ask the tester to retest and confirm closure. Feed repeated issues back into development and patching processes so they do not return.

How Affix Center Can Help

Affix Center is a Mumbai-based IT company that helps organisations plan VAPT scope, run testing across applications, networks and cloud, and close findings with practical fixes. Our cybersecurity services cover testing and remediation, and our cloud services team helps fix cloud configuration issues found during tests.

Planning a security test? Contact Affix Center to discuss your scope and timelines.