---
title: What is VAPT?
url: "https://cs.abinantony.io/answers/what-is-vapt"
updated: 2026-08-16
type: answer
source: Abin Antony Security
---

# What is VAPT?

> VAPT stands for Vulnerability Assessment and Penetration Testing. The vulnerability assessment is broad and largely automated, listing known weaknesses across a system. The penetration test is narrow and manual, proving which of those weaknesses can actually be exploited and what an attacker reaches through them. Most compliance frameworks expect both.

The two halves answer different questions. A vulnerability assessment answers "what looks wrong?" across everything you own — outdated packages, weak configurations, exposed services. A penetration test answers "what can someone actually do?" by chaining findings into a working attack path.

The distinction matters commercially, because a scan costs a fraction of a test and some vendors sell the first while naming it the second. The tell is in the deliverable: if every finding came from a tool and none includes a chained attack narrative or a business-impact statement, you bought an assessment.

For most Indian organisations, the practical answer is a periodic automated assessment for coverage — monthly or continuous — plus a manual penetration test annually and before any major release. CERT-In empanelled auditors are required for certain regulated filings; for everything else, methodology and the tester matter more than empanelment.

## Vulnerability assessment versus penetration testing

|  | Vulnerability assessment | Penetration test |
| --- | --- | --- |
| Method | Mostly automated scanning | Manual, tool-assisted |
| Breadth | Wide — everything reachable | Narrow — chosen targets in depth |
| Output | List of potential weaknesses | Proven attack paths with impact |
| False positives | Common, needs triage | Removed before reporting |
| Finds logic flaws | No | Yes |
| Typical frequency | Monthly or continuous | Annually and pre-release |

## In short

- Scanning gives coverage; manual testing gives certainty. You need both.
- Business-logic flaws are invisible to scanners by definition.
- Ask any VAPT vendor how many days a human spends testing.
- Regulated filings in India may require a CERT-In empanelled auditor — check before you buy.


## Sources

- [CERT-In](https://www.cert-in.org.in/)
- [NIST SP 800-115 Technical Guide to Information Security Testing](https://csrc.nist.gov/pubs/sp/800/115/final)

---

Abin Antony Security — Abin Antony, Kochi, Kerala. Contact: abina35@gmail.com · https://cs.abinantony.io