VAPT stands for Vulnerability Assessment and Penetration Testing: two security testing methods run together, one for breadth and one for depth, to find and prove exploitable weaknesses in your applications, APIs, cloud and networks.
The short answer
VAPT combines automated scanning, which identifies known weaknesses across a system, with manual expert-led exploitation, which confirms which of those weaknesses an attacker could actually use. The output is a prioritised report of validated findings with remediation steps and, after fixes, a retest.
On this page
The term is used mainly in India and across APAC. North America and Europe split the same work into two phrases, vulnerability scanning and penetration testing.
Most startups meet it when a questionnaire, an auditor or an investor asks for one. That is late: a critical finding then blocks a deal instead of becoming a sprint ticket.
Assessment vs penetration testing
The assessment half asks where you are exposed. The testing half asks what happens when someone actually tries.
Only the second one finds business logic flaws. Changing an order ID and getting back another customer’s invoice is something a human notices and a scanner never will.
| Dimension | Vulnerability assessment | Penetration testing |
|---|---|---|
| Question answered | What weaknesses exist? | What can an attacker actually do? |
| Method | Automated scanning for known CVEs | Manual testing and chained exploits |
| Business logic flaws | Not found | Found |
| False positives | Common, needs triage | Low, proven by exploitation |
| Cadence | Continuous | Annually, plus after big releases |
How to tell them apart in five seconds
Hundreds of findings and no proof of exploitation is a vulnerability assessment. A dozen findings with reproduction steps and evidence is a penetration test. A real VAPT contains both.
What a VAPT covers
Scope decides whether a VAPT is useful or theatre. Testing the marketing site while customer data sits behind an open internal API produces a clean report and no security.
| Scope | What gets tested | When to add it |
|---|---|---|
| Web application | Auth, sessions, tenant isolation, injection | First, the usual scope |
| API | Broken object level auth, rate limits, shadow endpoints | With the web app |
| Cloud | IAM sprawl, public storage, open security groups | Past one cloud account |
| Mobile app | Local storage, cert pinning, hardcoded secrets | If you ship a mobile client |
| Network | Exposed services, VPN, TLS, lateral movement | Self-managed infrastructure |
Engagements are also described by how much the tester starts with:
Black box
No access
Mirrors an external attacker, but burns hours on reconnaissance.
Grey box
User credentials
The usual SaaS choice, since most real attacks start with a valid account.
White box
Full source and credentials
Most thorough per hour spent, and the fastest route to depth.
How an engagement runs
Five phases. Teams skip the last one, which is the only one that produces the document an auditor or enterprise buyer asks for.
Ask to see a sample report first. It needs an executive summary, the exact scope and dates, evidence and reproduction steps per finding, named fixes, and a retest section.
Where frameworks require it
Only one of these actually names penetration testing as mandatory.
| Framework | Status | Where it appears |
|---|---|---|
| PCI DSS v4.0 | Required | Requirement 11.3: annual internal and external pentests, plus quarterly scans. |
| ISO 27001:2022 | Expected | Annex A 8.8 (technical vulnerabilities) and A 8.29 (security testing). |
| SOC 2 | Expected | Not named in the Criteria. Auditors want remediation evidence under CC4.1 and CC7.1, usually a VAPT report plus retest. |
| DPDP Act, 2023 | Implied | Requires reasonable security safeguards, not a named test. VAPT is the standard way to evidence them. |
| Buyer questionnaires | Asked | Date of your last test, who ran it, whether findings were fixed. |
The order that works
Close the findings first, then map the evidence to the framework. Teams that chase the certificate first end up with mapped controls, an open critical finding, and a report they cannot send to a customer.
How Osto runs VAPT
Osto runs VAPT inside the platform, not as a one-off engagement. Expert-led testing covers the depth; an AI scanner covers the breadth on a schedule instead of once a year.
Because testing sits in the same stack as the WAF, CSPM, code security and compliance modules, remediation and retest reports come out where the evidence already lives. That is why VAPT fits inside Osto’s 7-day SOC 2 readiness phase. The certificate is a byproduct of the security.
Free security assessment
See what an attacker would find first
Expert-led VAPT plus continuous AI scanning across your apps, APIs and cloud. Tell us your scope and we will tailor a plan.
Get a free security assessment Book a platform walkthroughFindings delivered in 7 days · Retest included · One platform, everything
Frequently asked questions
What is the full form of VAPT?
VAPT stands for Vulnerability Assessment and Penetration Testing: a combined engagement using automated scanning to find known weaknesses and manual expert testing to confirm which are actually exploitable.
Is VAPT the same as a penetration test?
No. A penetration test is one half of VAPT. The assessment gives breadth across all in-scope assets, the pentest gives depth on what matters most. A report containing only scanner output is not a pentest, and an auditor will not accept it as one.
How long does a VAPT take?
It depends on scope. A single web application is typically a few days to two weeks including reporting. Web, mobile, APIs and internal networks together can run several weeks. Automated scanning is far faster and runs continuously alongside the manual work.
Is VAPT mandatory for SOC 2?
The SOC 2 Trust Services Criteria do not name it as a required control. In practice auditors expect evidence that vulnerabilities are found and fixed under criteria such as CC4.1 and CC7.1, and a VAPT report with a retest is the usual way to provide it. PCI DSS does explicitly require annual pentesting under Requirement 11.3.
How often should a startup run VAPT?
A full penetration test at least annually and after any significant change, such as a new payment flow, a new auth provider or a cloud migration. Automated scanning continuously in between, and a retest after every remediation cycle.