VA, PT and VAPT: what you are paying for
Vulnerability assessment (VA) finds known weaknesses, usually with automated tools. Penetration testing (PT) goes further: a person tries to exploit weaknesses the way an attacker would. VAPT combines both. A report made only from scanner output is a vulnerability scan, not a penetration test, and it should not be priced like one.
What decides the price
| Factor | Smaller engagement | Larger engagement |
|---|---|---|
| Number of targets | One web application | Several apps, APIs, mobile apps and servers |
| Size of each target | A few pages and endpoints | Hundreds of endpoints and many user roles |
| Depth | Black box: no access given | Grey or white box: test accounts and architecture access |
| Manual testing | Scans plus quick manual checks | Substantial manual testing, including business-logic abuse |
| Environments | One | Web, API, mobile, network and cloud |
| Re-test | Not included | Included after you fix the issues |
| Report | Technical findings | Technical report plus a management summary for customers or auditors |
| Timeline | Planned ahead | Urgent, before a launch or an audit |
What a good quote should include
- A written scope: exactly which applications, APIs, apps and systems are tested.
- The type of test: black, grey or white box.
- A clear statement of how much testing is manual, not only automated.
- Whether a re-test after your fixes is included.
- What the report contains: each issue with its severity, proof it is real, and how to fix it, plus a management summary.
- An NDA, and rules for testing live systems.
- A timeline, and who does the testing, including their certifications.
Red flags in a VAPT quote
- A report that is only scanner output.
- No mention of manual testing.
- No re-test, so you never learn whether the fixes worked.
- No NDA before your details are shared.
- Findings listed without proof or fix steps.
- A promise of a guaranteed "clean" result.
When to test
- At least once a year.
- After major changes to your application or infrastructure.
- Before a launch.
- Before a customer security review or a compliance audit.
For what SOC 2, ISO 27001 and SEBI CSCRF expect, see our VAPT Testing 101 guide.
How we run VAPT at MOUNTSMY
- Scope first: what will be tested, when and from where, agreed and signed before we start.
- Automated scans plus manual testing by certified ethical hackers, done carefully so live systems stay up.
- A report with each issue's severity, proof and fix steps, and a short summary for management.
- A re-test once you have fixed the issues.
- An NDA before any details are shared.
We avoid destructive tests on live systems and, where possible, test a staging copy. You get a written quote after a free 30-minute call.
Frequently asked questions
Is a vulnerability scan the same as VAPT?
No. A scan is automated and finds known weaknesses. VAPT adds manual penetration testing, where a person tries to exploit weaknesses the way an attacker would.
Why do VAPT quotes differ so much?
Usually because the scope and depth differ: how many systems are tested, whether testing is manual, and whether a re-test and a management summary are included. Compare what each quote covers before comparing totals.
Do I need a re-test?
Yes, if you want to be sure your fixes worked. A re-test checks each issue again after you have fixed it.
Can testing break our live system?
We agree the scope and timing with you and avoid destructive tests on live systems. Where possible we test a staging copy.
How long does a VAPT take?
It depends on the size of the scope. You will get a timeline in the written quote.