“How much does VAPT cost?” is usually the first question a business asks, and the honest answer is uncomfortable: quotes for what looks like identical work routinely differ by a factor of ten. One vendor quotes ₹40,000. Another quotes ₹4,00,000. Both call it a vulnerability assessment and penetration test.
That gap is real, and it almost always reflects a genuine difference in what you are buying. This guide breaks down what VAPT costs in India in 2026, what actually moves the number, and how to tell a serious proposal from an expensive scan.
Why VAPT quotes vary so much
VAPT is not a product with a fixed unit price. It is a block of skilled human time wrapped around automated tooling. The tooling is cheap and broadly identical across vendors. The human time is neither.
An automated scanner can crawl a web application in an afternoon and produce several hundred findings, most of them noise. A senior tester spends days chaining low-severity issues into a working exploit, probing business logic that no scanner understands, and writing findings your developers can actually act on. Both engagements can legitimately be called VAPT. Only one of them tells you whether an attacker can get in.
So when you compare quotes, you are usually not comparing prices for the same work. You are comparing scan-and-report against test-and-prove.
VAPT cost in India: the 2026 price bands
Across Indian providers, VAPT pricing tends to cluster into four bands. Treat these as indicative market ranges for budget planning rather than as a quotation — real pricing depends entirely on scope.
| Band | Typical range | What you are buying |
|---|---|---|
| Automated scan | ₹25,000 – ₹60,000 | Tool output, lightly formatted |
| Single-scope manual | ₹75,000 – ₹2,50,000 | One asset, 5–15 days, senior tester |
| Multi-asset / deep scope | ₹3,00,000 – ₹12,00,000 | 2–4 testers, 20–40 days |
| Brand-backed enterprise | ₹15,00,000+ | Large consultancy, procurement-ready |
Band 1: Automated scan and report
A scanner run against your application or IP range, with the output formatted into a PDF. There is little or no manual validation, which means false positives stay in the report and business-logic flaws never surface at all. This is useful as a hygiene check, or when a client has asked for “a VAPT certificate” and nothing more. It is not a security assessment, and you should not budget for it as one.
Band 2: Single-scope manual testing
One asset — a web application, a mobile app or an API — tested by an experienced tester over roughly five to fifteen working days. Expect manual exploitation, authenticated testing across every user role, a report with reproduction steps and severity ratings, and a retest of fixed issues inside a defined window. This is the band most Indian SaaS companies and mid-sized businesses should be budgeting in.
Band 3: Multi-asset or deep-scope testing
Several assets tested together — web plus API plus mobile, or an internal network alongside the external perimeter — usually by a team of two to four testers across twenty to forty days. This band also covers extended single-asset engagements where the application is genuinely large or the threat model demands unusual depth.
Band 4: Brand-backed enterprise engagements
Large consultancies and Big Four practices. Part of what you pay for is testing; part of it is a name that clears enterprise procurement and regulatory review without argument. Sometimes that premium is exactly what the situation calls for.
Six things that actually move the price
1. Scope size and complexity
Testers price by asset, not by page. What counts: distinct applications, number of user roles, authenticated versus unauthenticated surface, third-party integrations, and API endpoints. Ten user roles cost meaningfully more than two, because each role has to be tested against every other role’s data.
2. Testing depth
A five-day engagement and a fifteen-day engagement against the same application produce very different findings. Depth is the single biggest lever on both cost and value.
3. Tester seniority
An experienced tester at OSCP or OSWE level commands several times the day rate of a junior running tools. Ask who is doing the testing, not only which company is doing it.
4. Compliance formatting
If your report has to satisfy PCI DSS, SOC 2, ISO 27001 or an RBI or SEBI-aligned audit, findings must be mapped to controls and evidence formatted accordingly. That adds days to the engagement.
5. Retest policy
Unlimited retesting inside a defined window costs more upfront than retesting billed hourly, and is usually cheaper in the end. Fixes fail verification more often than teams expect.
6. Report quality
Writing a report developers can act on takes three to five days of senior time. Vendors who skip that step are cheaper, and their reports get filed and forgotten.
What a genuine VAPT engagement includes
- A written scope document agreed before testing starts, listing every asset in and out of scope
- Authenticated testing across all user roles, not just anonymous scanning
- Manual validation of every reported finding, so the report contains no false positives
- Proof of exploitability for high and critical issues, with reproduction steps
- Severity ratings tied to a recognised scale such as CVSS, with business context applied
- A remediation call with your engineering team, not just a PDF handover
- A retest after fixes, and an updated report reflecting the closed issues
Warning signs in a cheap VAPT quote
- A fixed price quoted before anyone has asked what your application does
- No named tester, no CVs, no indication of who performs the work
- A turnaround of one or two days for a full application
- A sample report that is clearly raw scanner output with a logo on it
- Retesting excluded, or billed separately at an unspecified rate
- A “certificate” promised at the start, before any testing has happened
Which scope does your business need?
An early-stage product with one web application and no regulated data usually needs a single-scope manual test, repeated annually and after any major release. Budget in Band 2.
A business handling payment, health or customer financial data needs authenticated application testing plus network testing, with reports formatted for the relevant compliance regime. Budget in Band 2 to 3 depending on asset count.
An enterprise with internal infrastructure, multiple products and third-party integrations needs a multi-asset engagement, and should be planning a testing calendar rather than a one-off purchase. Budget in Band 3.
How to compare two VAPT proposals
- Normalise the scope. Write down the exact asset list each vendor is pricing and make them match before you compare rupees.
- Ask for total billable tester-days, not just a price. This exposes depth differences immediately.
- Ask for a redacted sample report from a comparable engagement.
- Confirm retest terms in writing, including the window and whether it is included.
- Ask who will be testing and what their experience is.
- Check what happens if a critical vulnerability is found mid-engagement — you want to be told immediately, not in the final report.
Frequently asked questions
Is VAPT a one-time exercise?
No. A penetration test reflects your systems on the days it was performed. Code changes, infrastructure changes and newly disclosed vulnerabilities all invalidate that snapshot. Most businesses test annually at minimum, and after any significant release or infrastructure change.
How long does a VAPT engagement take?
Testing itself typically runs five to fifteen working days for a single asset, plus three to five days for reporting. Multi-asset engagements run twenty to forty days. Add a week or two at the start for scoping and access provisioning.
Does VAPT guarantee we cannot be hacked?
No, and any vendor who suggests otherwise is selling you something. VAPT tells you which weaknesses a skilled attacker could exploit within the scope and time agreed. It reduces risk substantially; it does not eliminate it.
Do we still need VAPT if we have a firewall and antivirus?
Yes. Firewalls and antivirus defend against known threats at the perimeter and the endpoint. VAPT looks for the misconfigurations, logic flaws and access-control gaps that sit behind those defences. The two solve different problems — we cover the distinction in our guide to firewalls versus antivirus.
Will testing disrupt our production systems?
It should not. Testing against production is normal, but destructive tests are agreed in advance or excluded entirely, and testing windows are scheduled around your business hours. Where risk is high, testing runs against a staging environment that mirrors production.
Getting an accurate quote
Any serious provider will scope before they price. Expect questions about your asset list, user roles, technology stack, compliance drivers and testing window before a number appears.
If you want to understand the discipline before you buy, start with our explainer on what VAPT is and why businesses need it. For scoping and pricing on your own environment, see our VAPT services, or talk to our team through the contact page.
Price ranges in this guide are indicative market figures for India in 2026, compiled for budgeting purposes. They are not a quotation and will not reflect every provider or scope.
See also: best cyber security companies in Noida (2026) · IT AMC cost in India.