The two halves answer different questions. A vulnerability assessment answers "what looks wrong?" across everything you own — outdated packages, weak configurations, exposed services. A penetration test answers "what can someone actually do?" by chaining findings into a working attack path.
The distinction matters commercially, because a scan costs a fraction of a test and some vendors sell the first while naming it the second. The tell is in the deliverable: if every finding came from a tool and none includes a chained attack narrative or a business-impact statement, you bought an assessment.
For most Indian organisations, the practical answer is a periodic automated assessment for coverage — monthly or continuous — plus a manual penetration test annually and before any major release. CERT-In empanelled auditors are required for certain regulated filings; for everything else, methodology and the tester matter more than empanelment.
Vulnerability assessment versus penetration testing
| Vulnerability assessment | Penetration test | |
|---|---|---|
| Method | Mostly automated scanning | Manual, tool-assisted |
| Breadth | Wide — everything reachable | Narrow — chosen targets in depth |
| Output | List of potential weaknesses | Proven attack paths with impact |
| False positives | Common, needs triage | Removed before reporting |
| Finds logic flaws | No | Yes |
| Typical frequency | Monthly or continuous | Annually and pre-release |
In short
- Scanning gives coverage; manual testing gives certainty. You need both.
- Business-logic flaws are invisible to scanners by definition.
- Ask any VAPT vendor how many days a human spends testing.
- Regulated filings in India may require a CERT-In empanelled auditor — check before you buy.