VAPT Cost in India: Pricing Factors, Assessment Types, and What Businesses Should Expect in 2026

A ₹50,000 quote for VAPT and a 3 lakh quote may both promise to test your web application. But are they testing the same thing? The number of workflows, API endpoints, user privileges, and manual testing hours may paint a different picture. This article talks about VAPT cost in India 2026, average price, types of assessment, and what businesses should expect from their money. 

Main Points

• VAPT cost in India in 2026 starts from ₹40,000 for smaller assessments and goes up to ₹15 lakh for enterprise-wide testing. These are indicative prices, not fixed market rates.
• Pricing varies with the type of assessment. Web application VAPT is priced between ₹60,000-₹4 lakh+, mobile VAPT ₹80,000-₹2 lakh+, API testing ₹60,000-₹2.5 lakh+ and cloud assessments ₹80,000-₹5 lakh+.
• The cost of VAPT is driven by the scope and depth of testing. The final quote is impacted by factors such as the number of assets, complexity of applications, manual penetration testing, expertise of testers, compliance reporting, and retesting needs.
• Startups may need one application assessment, but SMEs and regulated enterprises need to budget for multiple systems, periodic testing, and applicable compliance obligations.
• Beyond price, compare VAPT quotes. Check manual testing coverage, methodology, authenticated testing, vulnerability evidence, remediation guidance, retesting terms, and GST before selecting a provider.

VAPT: What Is It and Why Should Indian Businesses Care in 2026?

Vulnerability Assessment and Penetration Testing (VAPT) is a security testing process that identifies vulnerabilities in websites, applications, APIs, and networks and determines whether they are exploitable. It is a mix of two activities:

• Vulnerability Assessment: Identifies security holes, outdated software, misconfigurations, and known vulnerabilities.
• Penetration Testing: Simulates controlled attacks to determine exploitability, potential impact, and effectiveness of security controls.

VAPT helps Indian enterprises identify authentication weaknesses, insecure APIs, exposed customer data, and vulnerabilities associated with payment processing in 2026 before attackers can exploit them. Such weaknesses may result in substantial financial costs. 

Offensive security testing such as penetration testing and red teaming was associated with an average lower breach cost of Rs 2.47 crore in India, according to IBM's Cost of a Data Breach Report 2026. VAPT also helps organisations to identify risks, prioritise fixes, and validate remediation, thereby supporting applicable RBI and SEBI security testing requirements. 

What Is the cost of VAPT in India in 2026?

The cost of VAPT in India in 2026 usually ranges from ₹40,000 for small assessments to ₹15 lakh or more for enterprise-wide testing. A small website may cost ₹60,000-₹80,000 just for assessment, while a medium-sized web application may cost ₹90,000-₹2.1 lakh. The total cost can go up if you are testing large applications, complex networks, or multiple business systems. The prices are indicative and are not fixed.

What Are The VAPT Assessment Types and How Much Do They Cost?

The VAPT cost in India varies based on the type of assessment, number of assets, complexity of the system, and manual testing effort. Below are some indicative cost ranges for a range of assessments in 2026.

1. Web App VAPT

Web application VAPT tests websites and applications running on browsers for Broken Authentication, Broken Controls of Access, Injection Flaws, Insecure Sessions & Business Logic Errors. Generally, the cost of VAPT for web applications in India is between ₹60,000 and ₹4,00,000+, depending on the application’s complexity, user roles, workflows, and extent of testing.

2. VAPT for Mobile App

Mobile application VAPT assesses Android and iOS applications for insecure data storage, authentication flaws, weak encryption implementations, and insecure communication with backend systems. The cost of VAPT for a mobile application normally ranges from ₹80,000 to ₹2,00,000+ depending on the coverage of the platform, functionality of the application, and whether it includes backend APIs or not.

3. API Security Testing

API security testing checks application interfaces for broken object-level authorisation, authentication vulnerabilities, improper input validation, and unauthorised access to sensitive data. The cost of API penetration testing in India usually ranges between ₹60,000 and ₹2,50,000 and above, depending upon the number of endpoints, authentication mechanisms, user permissions, and complexity of business workflows.

4. Network VAPT (Internal & External)

Network VAPT scans internet-facing infrastructure and internal networks for exposed services, insecure configurations, weak control of access, and potential privilege escalation paths. External network VAPT is usually in the range of ₹60,000 to ₹2,20,000+, and internal assessments range from ₹80,000 to ₹2,00,000+, depending on the number of assets, network segmentation, and testing scope.

5. Cloud Security Assessment

Cloud security assessments look at AWS, Microsoft Azure, and Google Cloud environments to find over-privileged IAM permissions, publicly exposed storage, insecure network configurations, and workload vulnerabilities. Testing cost varies from ₹80,000 to ₹5,00,000+ depending on the number of cloud accounts, services, workloads, and environments tested.

6. Testing: Black Box, Grey Box, White Box

Black box testing provides minimal internal information, grey box testing provides limited access or documentation, and white box testing offers extensive technical visibility, potentially including source code. These methodologies have no standard standalone price; their cost depends on the target systems, testing objectives, access provided, and manual testing effort required

What Drives the Cost of Your VAPT?

The cost of VAPT in India depends on many variables, including the scope of VAPT, the amount of manual testing involved, the expertise of the testers, and the reporting requirements.

• Scope and Environment Complexity: Testing a simple website costs less than testing SaaS applications that have various user roles, APIs, payment workflows, and cloud integrations. More the assets, endpoints and environments, more will be the time to test and overall cost of VAPT.
• Automated Testing vs Manual Testing Depth: Automated scans can identify known vulnerabilities and misconfigurations, whereas manual penetration testing looks for business logic flaws, access control weaknesses, and exploitable chains of vulnerabilities. The more testing done manually, the higher the costs.
• Tester Expertise and Methodology: The cost of VAPT depends on the expertise of the tester and the type of testing required (black box, grey box, or white box). Assessments may need extra expertise and effort for complex APIs, cloud environments, or source code reviews.
• Retesting and Remediation Validation: Some VAPT services include a round of retesting, while others charge separately for it. The number of vulnerabilities requiring verification and additional cycles of remediation can affect the final VAPT quote.
• Compliance and Reporting Requirements: Depending on the type of assessment (RBI, SEBI, or PCI DSS, etc.), there may be specific testing coverage, supporting evidence, and detailed documentation. The costs of testing may increase due to additional compliance mapping, audit-ready VAPT reports, and reporting requirements.

Automated vulnerability scans may not be able to identify authentication bypasses, privilege escalation paths, and business logic flaws, which must be manually investigated. Eventus Security’s automated vulnerability discovery and manual penetration testing cover web applications, APIs, mobile applications, networks and cloud environments. Its VAPT service portfolio includes exploitability validation, risk-based reporting, remediation recommendations, and retesting support to help businesses prioritise identified vulnerabilities and verify corrective actions taken.

How Much Should Your Business Spend on VAPT in a Year?

The annual budget for VAPT will be based on the number of planned assessments, the systems covered, and any applicable compliance requirements. Companies need to calculate their annual spend based on their own testing engagements, not on an industry average.

1. Early-Stage SaaS Companies and Startups

Indicative pricing by various Indian providers indicates that startups should be looking at a budget of ₹60,000–₹2.5 lakh for a single VAPT for a web application in a year. Standalone APIs, mobile apps, or large product launches from a SaaS company may need additional assessments, which will further increase the annual VAPT spend. 

2. Growing SMEs & Mid-Market Companies

SMEs have to budget separately for customer-facing applications, internal networks, and cloud infrastructure. For instance, an illustrative annual budget of ₹3 lakh (excluding taxes and additional services) would be required for two web application assessments at ₹1 lakh each and one network assessment at ₹1 lakh. Actual expenditure varies with scope and frequency of tests.

3. Large Enterprises and Regulated BFSI Companies

Banks, NBFCs, insurers and large enterprises typically require asset-wise VAPT budgets for relevant applications, APIs, networks and critical infrastructure. Multi-system assessments can run into several lakhs while complex infrastructure engagements can touch Rs 25 lakh. Annual expenditure depends on the number of engagements, applicable regulatory requirements, and required frequency of testing. 

4. Hidden Costs: Retesting, Reporting, and GST

A VAPT quote may not include additional rounds of retesting, remediation support, specialised compliance reports,  and assessments required after major system changes. Businesses should verify these inclusions before finalising their annual budget. Taxable domestic IT security services are subject to the 18% GST standard rate. So, GST would be ₹1.18 lakh on an assessment of ₹1 lakh.

What to Expect from VAPT in India in 2026 for Businesses?

In addition to testing costs, businesses operating in India need to consider applicable regulations, auditor qualifications, assessment frequency, and reporting requirements when planning for VAPT services.

Regulatory Requirements Under RBI, SEBI and DPDP

RBI requires covered regulated entities to conduct vulnerability assessments at least every six months and penetration tests annually for critical or customer-facing DMZ systems. SEBI's CSCRF establishes security testing requirements for applicable entities. The DPDP framework introduces security safeguard obligations, but does not mandate annual VAPT for every business.  

When Is a CERT-In Empanelled Auditor Required?

SEBI's CSCRF requires CERT-In empanelled auditors for VAPT and cyber audits covered by its auditor selection norms. Other businesses should check applicable regulations and contractual requirements before selecting a VAPT company in India. CERT-In empanelment is not mandatory for every private-sector assessment.

Also Read: CERT-In VAPT Guidelines: Scope, Methodology and Deliverables

Periodic VAPT vs. Continuous Vulnerability Assessment

Periodic VAPT includes scheduled assessments to find and validate exploitable weaknesses, while continuous vulnerability scanning helps locate known vulnerabilities between assessments. Businesses can benefit from additional penetration testing after major application releases, infrastructure changes, or substantial API changes.

VAPT Deliverables, Re-Tests and Timelines

A typical engagement involves scope definition, rules of engagement, vulnerability discovery, controlled exploitation, and reporting. Timelines depend on asset count and depth of manual testing. The final VAPT report should contain affected assets, severity ratings, reproduction evidence, and remediation recommendations. It is followed by fixed verification if retesting is part of the project.

How to Compare VAPT Quotes and Avoid Paying for a Scan?

A VAPT quote should clearly delineate between automated vulnerability scanning and manual penetration testing. Before comparing prices, businesses should check the scope, methodology, deliverables, and remediation support offered.

Red Flags in Low Bids

A low-cost VAPT quote may mean limited testing coverage, especially if the provider is relying heavily on automated scanners. What to look for:

• No defined hours and scope for manual penetration testing.
• Testing is limited to known CVEs and automated OWASP scans.
• No testing of user roles, APIs, or business workflows for authentication.
• Scanners without substantiation generating generic reports.
• Remediation retesting and verification were excluded without clear disclosure.

Questions to Ask Before Signing

Consult the testing company before finalising VAPT services:

• Which applications, IP addresses, API endpoints, and environments are included?
• What manual testing methodology and security standards are going to be adhered to?
• Will testing detect vulnerabilities in authentication, authorisation, and business logic?
• Does it include remediation guidance, evidence of exploitation, and retesting?
• When is testing being done? What are the exclusions and additional fees?

What Makes a Good VAPT Report

A professional VAPT report is supposed to cover the scope of the assessment, testing methodology, and security findings. Each finding should contain the affected asset, description of the vulnerability, severity rating with justification, reproduction steps, evidence, and actionable remediation recommendations. 

The report should also distinguish between confirmed vulnerabilities and scanner alerts that have not been verified and provide results from retesting, if applicable.

How Does Eventus Security Help to Perform Successful VAPT Assessments?

A VAPT assessment should help businesses to identify exploitable vulnerabilities, understand the possible effects of these and prioritise remediation. Eventus Security offers vulnerability assessment and penetration testing services that blend automated vulnerability discovery with manual penetration testing. This approach includes applications, APIs, networks, and cloud environments, supported by technical reporting and remediation guidance.

Here’s how Eventus Security helps with business VAPT needs:

• Application and Infrastructure Testing: Tests web and mobile applications, APIs, internal and external networks, cloud environments, Active Directory, and Kubernetes deployments as per the agreed scope.
• Manual Vulnerability Validation: Tests weaknesses in authentication, access control, business logic vulnerabilities, privilege escalation, and possible attack paths using controlled penetration testing.
• Risk-based reporting: Documents identified vulnerabilities, affected systems, severity ratings, supporting evidence, and prioritised remediation recommendations to guide security teams.
• Remediation verification: Offers remediation guidance and retesting support to help organisations determine if reported vulnerabilities have been fixed.
• Ongoing testing through PTaaS: Offers Penetration Testing as a Service (PTaaS) with recurring testing cycles, dashboard visibility, and CI/CD integration for organisations requiring more frequent security assessments.

Frequently Asked Questions

1. How frequently should a business do VAPT?

Companies should plan for yearly VAPT and other assessments following major changes to systems. Frequency of testing is determined by risk and regulations. Some RBI-regulated systems require vulnerability assessments every six months and penetration testing annually.

2. What is the difference between VAPT and penetration testing?

VAPT is a combination of vulnerability assessment and penetration testing. Vulnerability assessment identifies security weaknesses, whereas penetration testing attempts controlled exploitation to determine their impact. Hence, penetration testing is just a part of a bigger VAPT engagement.

3. Does VAPT price include retesting?

Retesting is not automatically included in the VAPT pricing. Some providers include one verification round; others charge separately. Businesses should check the scope of retesting, the timeframes, any extra fees, and whether an updated report will be provided.

4. Is VAPT mandatory for SOC 2, ISO 27001, or RBI Compliance?

SOC 2 and ISO 27001 do not universally mandate a standalone annual VAPT engagement, although testing may support security assurance. Applicable RBI directions explicitly require periodic vulnerability assessments and penetration testing for specified systems.