VAPT Services: Find What an Attacker Would, Then Prove It Is Fixed
VAPT services for networks, web applications, APIs, mobile apps, and cloud environments. We scope the test, run it to recognized methods, and rank every finding by real risk. Then we retest your fixes, so the report you hand to auditors and customers shows a closed loop.
What Are VAPT Services?
VAPT services combine two kinds of security testing. A vulnerability assessment scans your systems and lists known weaknesses, ranked by severity. A penetration test goes further: skilled testers try to exploit those weaknesses, chaining them together to show what an attacker could reach. Together they tell you what is wrong and what it would cost you.
There is no such thing as a VAPT certificate. What you get is a report, a letter confirming the scope and dates of testing, and retest results showing which findings you closed. That is the evidence PCI DSS assessors, ISO 27001 auditors, and enterprise customers ask to see.
Testing is delivered by our own testers or by qualified specialist partners, depending on the systems and skills involved. Accredify Global runs the engagement from scoping to retest in both cases.
Penetration Testing Requirements in 2026
Regulators are naming penetration testing outright. All PCI DSS v4.0.1 requirements have been mandatory since 31 March 2025, including authenticated internal scanning. In Brazil, financial institutions must run an annual intrusion test by an independent company from 1 March 2026.
EU financial entities face advanced testing. The EU's rules on threat-led penetration testing under DORA, Delegated Regulation (EU) 2025/1190, apply from 8 July 2025. Significant entities run red-team exercises every three years, following the TIBER-EU approach.
Customers ask for proof, not promises. Enterprise security questionnaires now routinely request a recent penetration test summary and evidence of retesting. A report older than a year, or one with open critical findings, often stalls a deal.
Sources: DORA TLPT regulation (Katten) · BACEN intrusion testing (Baker McKenzie) · NIST SP 800-115
Types of VAPT Testing
Each target needs its own method. Your scope lists them separately, so nothing is assumed.
| Test type | What it covers | Typical findings |
|---|---|---|
| External network | Internet-facing hosts, VPNs, and exposed services | Unpatched services and weak remote access |
| Internal network | What an attacker inside, or a rogue device, could reach | Excess privileges and flat networks |
| Web application | Authentication, sessions, input handling, and business logic | Access control flaws and injection |
| API | Endpoints, tokens, and data exposure between roles | Broken object-level authorization |
| Mobile app | The app, its storage, and its backend calls | Secrets in the app and weak certificate checks |
| Cloud configuration | Identity, storage, network, and logging settings | Public storage and over-broad roles |
| Segmentation | Isolation of card data or payment environments | Paths from office networks into restricted zones |
Newer targets need their own approach. Applications with AI features can leak data through prompts, so we test how models handle untrusted input and what they can reach. That evidence also supports an ISO 42001 AI management system. Systems that hold personal data are tested for exposure between users and roles, which feeds into ISO 27701 and GDPR work. Banks and payment firms usually add segmentation tests around payment systems, and our financial services page covers the wider picture. Grey-box testing, where testers get accounts for each role, usually finds more in less time than black-box testing. It is the default we recommend for applications and APIs.
Which Frameworks Require Penetration Testing?
Some name it directly. Others expect it as proof that vulnerability controls work.
| Framework | What it expects |
|---|---|
| PCI DSS v4.0.1 | Internal and external tests every 12 months and after significant change |
| ISO 27001 | Technical vulnerability management and security testing; reports are common evidence |
| SOC 2 | Monitoring and risk activities; CPA auditors often review test reports |
| BACEN rules | An annual intrusion test by a specialized independent company |
| DORA | A resilience testing program, and TLPT for significant entities |
| HIPAA | Risk analysis and evaluation of safeguards, often supported by testing |
One well-scoped test can serve several of these at once. We map each finding to the frameworks you report against, so your PCI DSS assessor and ISO 27001 auditor can both use the same report. For government work in India, check whether the buyer requires a CERT-In empanelled auditor before you scope.
How Our VAPT Services Work
Six steps, from a signed authorization to a retested, closed report. The rules of engagement also set how fast critical findings are escalated to you.
Need a report before an audit, a renewal, or a customer review? Share the date in your scoping review.
Book a free scoping reviewWhat a VAPT Report Includes
Overall risk in plain language for leadership and customers.
Targets, dates, accounts, and the methods used.
CVSS severity, evidence, and business impact for each issue.
Specific steps your engineers can act on.
Which findings are closed, and how that was confirmed.
A short letter confirming scope and dates, to share with customers.
Impartiality matters if we also certify your management system. Where that applies, we explain at scoping how testing is kept separate from the certification audit. The people who test your systems do not audit your ISO 27001 management system.
VAPT Cost and Timeline
VAPT pricing has no list price. Effort depends on what is tested and how deeply, and a free scoping review gives you a tailored proposal.
What sets the effort
- Targets — IP ranges, applications, APIs, and mobile apps
- User roles — each role tested for access control
- Depth — black box, grey box, or white box
- Environments — production, staging, or both
- Retesting — how many rounds you need
Planning the timeline
| Scoping and authorization | Agreed before testing starts |
|---|---|
| Testing window | Set in your proposal |
| Retest | After your team's fixes |
| Repeat | At least yearly and after major change |
How to Choose VAPT Services
Questions to ask any VAPT provider, and how Accredify Global answers them.
| Question | Accredify Global's answer |
|---|---|
| Is it more than an automated scan? | Yes. Manual testing proves impact. |
| Is retesting included? | Yes, as agreed in your proposal. |
| Who does the testing? | Our testers or qualified partners, managed by us. |
| Can you issue a VAPT certificate? | No one can. You get a report and a completion letter. |
| Do you fix the findings? | No. Your team fixes them; we retest. |
| How is it priced? | A tailored proposal after a free scoping review. |
Frequently Asked Questions About VAPT
Answers on testing types, frequency, PCI DSS, DORA, impartiality, and cost.
What is VAPT?
VAPT stands for vulnerability assessment and penetration testing. A vulnerability assessment finds and ranks known weaknesses across your systems. A penetration test then tries to exploit them, the way an attacker would, to show what is really at risk.
Is there a VAPT certification?
No. VAPT is a testing engagement, not a certification. You receive a report of findings and, once testing is complete, a letter confirming the scope and dates of the test. Retest results show which findings were fixed.
What is the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment is broad and largely automated, and it lists weaknesses. A penetration test is narrower and manual. Testers chain weaknesses together to prove impact, such as reaching customer data.
How often should we run VAPT?
At least once a year and after significant changes, such as a new product release or network change. PCI DSS, BACEN rules and many customer contracts set annual minimums, and quarterly scanning is common.
Does PCI DSS require penetration testing?
Yes. PCI DSS v4.0.1 requires internal and external penetration testing at least once every 12 months and after significant changes. Service providers using segmentation must test it every six months.
Does ISO 27001 require penetration testing?
Not by name. ISO 27001 requires management of technical vulnerabilities and testing of security in development. Penetration testing is the usual way to show those controls work, and auditors often ask for the report.
What methodology do your testers follow?
Testing follows recognized methods, such as the OWASP Web Security Testing Guide for applications and NIST SP 800-115 for technical testing. Findings are scored with CVSS so you can compare and prioritize them.
Who performs the testing?
Testing is delivered by our own testers or by qualified specialist partners, depending on the systems and skills needed. Accredify Global manages the engagement from scoping to retest in either case.
What about impartiality if you also certify us?
If we are also your certification body, we explain at scoping how testing is kept separate from the certification audit. The people who test your systems do not audit your management system.
Will testing disrupt our production systems?
Testing is planned to avoid disruption. Rules of engagement set the targets, timing, accounts and stop conditions, and higher-risk tests can run in staging or outside business hours.
What do we need to provide before testing?
A signed authorization, the targets in scope, test accounts for each user role, contacts for emergencies, and any cloud provider notices. For cloud platforms, check the provider's own testing policy.
What is TLPT under DORA?
Threat-led penetration testing is advanced red-team testing for significant EU financial entities. Its rules, Delegated Regulation (EU) 2025/1190, apply from 8 July 2025. TLPT follows the TIBER-EU approach and needs specialist testers.
Can VAPT be done for mobile apps and APIs?
Yes. Mobile apps, APIs and cloud configurations are common targets. Each has its own test approach and is listed separately in the scope.
How much does VAPT cost?
There is no list price. The cost follows the number of targets, such as IP addresses, applications, user roles and API endpoints, plus retesting. A free scoping review gives you a tailored proposal.
Do you fix the vulnerabilities?
No. Your team fixes them, using the remediation guidance in the report. We then retest to confirm each fix and update the report.
Find Your Weak Spots Before Someone Else Does
Tell us about your systems, deadlines, and the frameworks you report against. We'll scope the right VAPT services and send a tailored proposal.
Book your free scoping review →Last reviewed by the Accredify Global security team.