VAPT Cost in India

VAPT pricing in India is driven almost entirely by skilled person-days, not by the number of assets. A single web application typically needs 5 to 15 working days including reporting. A mid-size internal network assessment runs 3 to 6 weeks. A quote dramatically below market is almost always an automated scan being sold as a penetration test.

Written for the buying side, though testers should read it too, because knowing how the work is priced changes how you scope it.

What you are actually paying for

Not tools. Not a report template. Skilled human hours.

A vulnerability scan is measured in compute time and costs almost nothing to run. A penetration test is measured in person-days of someone who can find the flaws a scanner cannot. The difference between the two is the difference in the invoice, and it is also the difference in whether the engagement is worth anything. Detail in VAPT vs penetration testing.

Effort by asset type

Multiply by a day rate and add reporting. Reporting is typically twenty to thirty percent of total effort and any quote that omits it is quoting for something else.

What genuinely increases cost

• Number of user roles. Access control testing multiplies with roles, not with pages. Three roles is roughly three times the authorisation surface.
• Retest included. It should be. A finding is not closed until the fix is verified.
• Compliance formatting. Reports for CERT-In or regulator submission need specific structure and evidence.
• Restricted windows. Testing only at night or only on weekends costs more.
• Source code access. Raises cost and raises findings per rupee. Usually worth it.

What does not increase cost as much as vendors claim

• Raw page count. Fifty pages using the same three templates is not fifty pages of testing.
• Technology stack. A competent tester works across stacks.
• Number of IPs on an external scan, beyond a point. The scan scales; the human review does not.

Reading a suspiciously cheap quote

Five questions that separate a real test from a scan with a cover page:

1. How many person-days of manual testing are included?
2. Will the report contain proof of exploitation, with requests and responses?
3. Are business logic flaws in scope? Ask for an example from a past engagement.
4. Is a retest included after remediation, at no extra cost?
5. Who specifically is testing, and what are their credentials?

A vendor who cannot answer the first question has no manual testing in the quote. That is not always the wrong purchase, but you should know which product you are buying.

Why compliance changes the calculation

For a regulated entity the question is not only whether the test finds problems. It is whether the auditor accepts the evidence. That usually means an empanelled auditor and a specific report format. See CERT-In VAPT requirements.

Worth separating clearly: empanelment answers will this satisfy my regulator. Methodology and person-days answer will this actually find our problems. Those are different questions and organisations conflate them constantly.

How to scope so you do not overpay

1. Give the vendor an accurate asset inventory up front. Vague scope gets padded.
2. Provide credentials for every role. Grey box finds more per day than black box.
3. Test the things that hold data, money or identity first. Not everything, every year.
4. Run automated scanning yourself, continuously, between annual tests. Do not pay consulting rates for coverage a scanner gives you.
5. Insist retest is in the contract, not a change request.

For testers reading this

Understanding pricing makes you better at scoping conversations, which is a senior skill. It also explains why reporting is not optional: the report is the deliverable the client is paying for. Structure in how to write a VAPT report.