What is VAPT? A plain-language guide
Short answer: VAPT stands for Vulnerability Assessment and Penetration Testing. A vulnerability assessment scans your systems to find known weaknesses. A penetration test goes further: a tester tries to exploit those weaknesses to show what an attacker could really do. Together they tell you what is exposed and what to fix first.
What is the difference between a vulnerability assessment and a penetration test?
| Vulnerability assessment | Penetration test | |
|---|---|---|
| Goal | Find as many known weaknesses as possible | Prove how far an attacker could get |
| How | Mostly automated scanning | Skilled tester, manual and tool-assisted |
| Coverage | Broad | Deep, on a defined target |
| How often | Often: monthly, quarterly or on every release | Usually yearly and after major changes |
What does VAPT cover?
- Web applications and APIs: injection flaws such as SQL injection, cross-site scripting (XSS), broken access control, weak authentication.
- Source code: hard-coded secrets, unsafe functions, weak cryptography.
- Website configuration: missing security headers, insecure cookies, weak TLS, exposed admin paths and files.
- Networks and servers: open ports, outdated software, misconfigurations.
- AI features: prompt injection and unsafe handling of model output in apps built on large language models.
Findings are usually mapped to common lists such as the OWASP Top 10 and CWE, so developers know exactly what kind of problem each one is.
How often should you do VAPT?
At a minimum, once a year and after any significant change, such as a new product, a major release or a move to new infrastructure. Automated scanning is worth running much more often, ideally as part of every release. PCI DSS, for example, requires vulnerability scans at least every three months and penetration tests at least once a year.
Is VAPT mandatory in India?
For many businesses it is expected rather than written into a single law. Regulators such as RBI and SEBI expect the entities they regulate to run VAPT regularly, government projects often require an audit by a CERT-In empanelled auditor, and ISO 27001, SOC 2 and PCI DSS all expect you to find and fix technical vulnerabilities. Enterprise customers increasingly ask for a recent VAPT report before they sign.
What happens after a VAPT?
- Prioritise. Fix critical and high findings first, especially anything exposed to the internet or actively exploited.
- Fix. Each finding should come with clear steps your developers can follow.
- Retest. Confirm the fix works and did not break anything else.
- Track. Keep a risk register of what was found, fixed or accepted, with evidence for auditors.
How ExpertComply VAPT helps
ExpertComply VAPT scans pasted code for issues such as SQL injection, secrets, XSS, weak cryptography and AI/LLM risks, and checks a website's headers, cookies, TLS and exposed paths. Every finding is explained in plain language, mapped to OWASP Top 10 and CWE, and comes with a ready-to-paste prompt for your AI coding assistant. VAPT keeps its own risk register and evidence vault, separate from GRC.
Automated scanning finds a lot, but it does not replace a manual penetration test by a qualified tester where your regulator or customer requires one.