What Is VAPT? A Complete Guide for 2026

VAPT (Vulnerability Assessment and Penetration Testing) is a two-part security testing process. Vulnerability assessment finds and catalogues weaknesses across a system. Penetration testing then exploits those weaknesses to prove real-world impact. Together they answer two different questions: what is broken, and what happens when someone actually attacks it.

Most explanations stop there, and that is why most people who can define VAPT cannot perform it. This guide covers what the work actually involves, how the two halves differ in practice, and why Indian regulators now mandate it. If you want the structured version, our VAPT training program teaches this end to end with live targets.

VAPT full form and meaning

VAPT stands for Vulnerability Assessment and Penetration Testing. It is a combined term, more common in India and the Middle East than in the US or Europe, where the two activities are usually named separately.

The pairing exists because the two on their own are incomplete. A vulnerability assessment gives you a list with no proof. A penetration test gives you proof with no coverage. Regulators wanted both, so the industry started selling both, and the acronym stuck.

Vulnerability assessment vs penetration testing

The practical difference: a vulnerability scanner tells you a server runs an outdated library. A penetration tester tells you that outdated library let them read your customer database, and here is the screenshot.

That distinction decides budgets. "We have 400 medium severity findings" gets ignored. "We extracted 12,000 customer records in ninety minutes" gets funded. Full breakdown in VAPT vs penetration testing.

The six phases of a VAPT engagement

1. Scoping

Defining what is in scope, what is explicitly out, the testing window, and the rules of engagement. Also where legal authorisation is signed. Testing outside an agreed scope is a crime in India under the IT Act regardless of intent, and this is the phase most self-taught testers skip.

2. Reconnaissance and enumeration

Mapping the attack surface. Subdomain discovery, port scanning, service fingerprinting, technology identification, and finding the parts of the estate nobody remembered existed. Tools: Nmap, Amass, Gobuster, httpx. In most real engagements the finding that matters was in an asset the client did not know they had.

3. Vulnerability assessment

Automated and semi-automated scanning across the mapped surface. Nessus, OpenVAS, Nikto, OWASP ZAP. This produces volume, and most of it is noise. The skill is triage, deciding which of 400 findings is worth a human hour.

4. Exploitation

Manual attack against the findings that survived triage. This is where a real tester separates from a scanner operator. SQL injection to database access. Broken authentication to account takeover. A single Kerberoastable service account to domain admin. Tools: Burp Suite, Metasploit, SQLmap, BloodHound, Mimikatz.

5. Post-exploitation and lateral movement

The phase most courses skip entirely. Landing a shell is not the finding. What you reach from that shell is the finding. Privilege escalation, credential harvesting, pivoting to internal networks, persistence. The business impact of a breach is almost always determined here, not at the initial entry point.

6. Reporting and retest

The deliverable is the report, not the exploit. Executive summary for people who decide budgets, technical detail with reproduction steps for the engineers who fix it, and severity ratings that hold up when challenged. Then a retest after remediation to confirm the fix works. See how to write a VAPT report.

Types of VAPT

• Web application VAPT. The most common by volume. OWASP Top 10, business logic flaws, authentication and session handling, access control.
• Network VAPT. Internal and external infrastructure. Misconfigured services, weak credentials, unpatched systems, Active Directory attack paths.
• API VAPT. Growing fastest. Broken object level authorisation (BOLA), excessive data exposure, missing rate limits. Most APIs are tested far less than the apps in front of them.
• Mobile VAPT. Android and iOS. Insecure local storage, certificate pinning bypass, hardcoded secrets, weak IPC.
• Cloud VAPT. AWS, Azure, GCP. IAM misconfiguration, exposed storage, over-permissive roles, metadata service abuse.
• AI and LLM security testing. Newest category. Prompt injection, model extraction, training data leakage, agent tool abuse. See prompt injection explained.

Black box, grey box and white box

Black box: no prior knowledge, testing from an outsider's position. Realistic, but time is spent on discovery rather than depth.

Grey box: partial knowledge, usually credentials for a normal user account. The most common commercial choice, because it simulates the most realistic serious threat, an attacker who already has a foothold.

White box: full access including source code and architecture. Best coverage per rupee spent. Most organisations avoid it because it feels like cheating, which is a bad reason.

Why VAPT is mandatory in India

VAPT stopped being optional for a large part of the Indian market. Several regimes require it:

• CERT-In directions require periodic security auditing for a wide range of entities, and CERT-In empanelled auditors are the mechanism
• RBI cyber security frameworks mandate VAPT for banks, NBFCs and payment operators
• SEBI CSCRF requires it for regulated market intermediaries
• ISO 27001 certification requires technical vulnerability management
• PCI-DSS requires it for anyone handling card data

This is why VAPT demand in India is structurally different from the West. A large share of the work is compliance-driven rather than security-driven, and that has created steady, non-cyclical hiring. Detail in CERT-In VAPT requirements.

Tools used in VAPT

A note worth making: the tool list is the least important part of this article. Every tester uses roughly the same tools. What separates them is knowing which finding matters, and being able to explain it to someone who controls a budget.

How to learn VAPT

The honest sequence, and the one we teach in:

1. Networking and Linux fundamentals. Not optional. You cannot exploit what you cannot describe.
2. Web fundamentals. HTTP, cookies, sessions, same-origin policy, how authentication actually works.
3. OWASP Top 10, hands on. Reading about SQL injection teaches you nothing. Exploiting fifty of them teaches you the pattern.
4. Tooling depth. Burp Suite properly, not just Proxy. Repeater, Intruder, Comparer, extensions.
5. Network and Active Directory. Where the majority of Indian enterprise engagements actually land.
6. Reporting. The skill that decides whether you stay a junior. Almost nobody teaches it.

Practise this

Reading about VAPT is the least useful way to learn it. Start on Hacklido, our free CTF and lab platform. Web, network and API challenges with a progression path from zero. No enrolment, no payment.

When you want structure, a live mentor and a certification, the TCVE VAPT program covers everything above across three months with live sessions.

Frequently asked questions

What is the full form of VAPT?

Vulnerability Assessment and Penetration Testing. Two distinct activities usually sold and performed together.

Is VAPT the same as ethical hacking?

Not quite. Ethical hacking is the broader discipline. VAPT is a specific, scoped and contracted engagement with a defined deliverable, a report. All VAPT is ethical hacking; not all ethical hacking is VAPT.

How long does a VAPT engagement take?

A single web application typically takes 5 to 15 working days including reporting. A full internal network assessment for a mid-size enterprise runs 3 to 6 weeks. Scope size is the main driver.

Do I need coding to do VAPT?

You need to read code more than write it. Enough Python to modify an exploit and enough JavaScript, SQL and PHP to understand what you are looking at. You do not need to be a software engineer.

What is the salary of a VAPT engineer in India?

Entry level roles typically start in the 4 to 7 LPA range, with experienced testers moving significantly higher. Full breakdown in our VAPT engineer salary guide.

Which certification is best for VAPT?

OSCP carries the most weight with Indian employers for hands-on roles. CEH appears most often in job descriptions, particularly for compliance-driven positions. Comparison in OSCP vs CEH.