Answers
About this page
This page collects direct answers to the questions teams ask before commissioning a security assessment — what a penetration test costs in India, how long one takes, what VAPT means, what a report should contain and how often testing should happen. Each answer is dated and maintained.
A professional penetration test in India typically costs between ₹60,000 and ₹4,00,000 depending on scope. A single web application usually lands at ₹75,000 to ₹1,50,000, a mobile app with its backend at ₹85,000 to ₹2,00,000, and a small cloud environment at ₹70,000 to ₹1,50,000. Price is driven by testable surface, not company size.
A typical application penetration test takes two to three weeks from kickoff to final report: two to three days of scoping and setup, five to ten days of active testing, three to five days for reporting, and a retest once fixes ship. Larger environments or multiple applications extend the testing phase proportionally.
VAPT stands for Vulnerability Assessment and Penetration Testing. The vulnerability assessment is broad and largely automated, listing known weaknesses across a system. The penetration test is narrow and manual, proving which of those weaknesses can actually be exploited and what an attacker reaches through them. Most compliance frameworks expect both.
A vulnerability scan is an automated tool that compares your system against a database of known weaknesses and reports matches. A penetration test is a human attacking your system with the tools plus judgement, proving which weaknesses are exploitable, chaining them, and finding logic flaws that exist in no signature database.
Test at least once a year, and additionally after any change that alters your attack surface: a new authentication system, a major architecture refactor, a first payment integration, a new public API, or a merger that connects two environments. Products shipping continuously should pair an annual full test with lighter release-time reviews.
A pre-launch penetration test is worth it if your product handles payments, personal data, health or financial records, or user-generated content. If it does not, a threat-modelling session plus a secure code review usually buys more security per rupee at that stage, because there are still few users and the architecture can still change cheaply.
OWASP MASVS is the Mobile Application Security Verification Standard: a public list of security controls that Android and iOS apps are tested against. It defines what "secure" means for storage, cryptography, authentication, network communication, platform interaction and code quality, at two verification levels plus an optional resilience set.
Flutter neither adds nor removes security by itself. The common weaknesses in Flutter apps are the same ones found elsewhere — secrets compiled into the bundle, data stored unencrypted, missing certificate pinning and authorisation enforced only in the UI — but the Dart snapshot changes how easily an attacker recovers logic and strings.
A penetration test report contains an executive summary, the scope and methodology used, a findings section with evidence, reproduction steps and severity ratings, specific remediation guidance for each issue, and a retest record confirming which findings were closed. Anything without reproduction steps and a named methodology is a scanner export.
Fix insecure Android storage by keeping secrets out of the device entirely where possible, storing anything unavoidable in Keystore-backed encrypted storage rather than plain SharedPreferences, excluding sensitive files from auto-backup, disabling verbose logging in release builds, and clearing cached responses and databases on logout.
API security testing assesses REST, GraphQL or gRPC endpoints directly, independently of any client application. It targets broken object and function level authorisation, weak token handling, mass assignment, excessive data exposure and missing rate limits — the OWASP API Security Top 10 — using paired accounts to prove cross-account access rather than infer it.
Prepare for a security audit by inventorying systems, data and third parties; collecting evidence that your existing controls actually run; commissioning an honest gap assessment before the auditor arrives; and having a recent penetration test report with a retest record. Most audit failures are missing evidence, not missing controls.
Ask it directly — answers that come up more than once end up on this page.