VITI Security
Contact

Service · VAPT

VAPT services - exploit-grade, standards-aligned.

Vulnerability assessment and penetration testing on infra, web apps, APIs, mobile, and cloud. CERT-In-aligned methodology; OWASP + NIST 800-115 + PTES across the rest of the stack.

Get a quote →Read a full sample report

What we test

What our VAPT services cover.

Every engagement combines automated scanning (Vexta + commercial tools) with manual exploitation by a senior pentester.

External network

Internet-facing assets: web servers, mail, VPN, exposed services. CVE + misconfig + exposed credentials.

Internal network

Authenticated assessment of the LAN: lateral movement, privilege escalation, AD/identity weaknesses.

Web applications

OWASP Top 10 + business-logic + auth/authz. Manual testing, not just scanner output.

APIs (REST + GraphQL)

Auth, authz, rate limits, injection, data exposure. OpenAPI-spec-driven or proxy-captured.

Mobile (iOS + Android)

Static + dynamic analysis. Reverse-engineering. Cert pinning, secure storage, IPC.

Cloud (AWS / GCP / Azure)

IAM, public buckets, exposed secrets, misconfigured services. Mapped to CIS benchmarks.

Assessment or penetration test

VAPT is two different jobs sold under one acronym.

Vulnerability assessment is breadth: cover the whole estate, find everything known, prioritise it. Penetration testing is depth: take a small number of targets and find what a determined attacker would do with them, including the things no scanner will ever surface. Most buyers are quoted one and are expecting the other, and the gap only becomes obvious when the report arrives.

  • Assessment answers "what is exposed across everything we own". It is the right purchase when you have never looked, when you need a baseline, or when compliance asks for regular scanning.
  • Penetration testing answers "what can somebody actually do to us". It is the right purchase before a launch, after a big architectural change, or when a customer contract specifies it.
  • Business-logic flaws, chained privilege escalation, authorisation bypasses and race conditions do not appear in scanner output at all. Only manual testing finds them, and they are usually the findings that matter most.
  • Our reports label which findings came from automation and which from manual testing, so you can see exactly what you paid for rather than taking the total on trust.
Get a scope priced →
VAPT is two different jobs sold under one acronym.

What is in the report

The deliverable, in detail.

You can read the whole thing before you buy - the full sample report is published, not gated behind a form.

Executive summary

One page for whoever funds the remediation. Business risk in plain English, no CVSS soup, no jargon that needs a translator in the room.

Findings ranked by exploitability

Ordered by what an attacker could realistically do against your specific setup, not by raw CVSS. A critical on an unreachable asset outranks nothing.

Reproduction steps for every finding

Enough detail for your engineers to confirm it themselves. A finding your team cannot reproduce is a finding they will not fix, and rightly so.

Remediation tied to your stack

The specific fix, a complexity estimate, and sequencing so the highest-risk items are also the ones you can ship first.

Evidence for auditors

Mapped to the standard you are being measured against - CERT-In, OWASP, NIST SP 800-115, PCI-DSS or SOC 2 - so the report is usable in an audit rather than only internally.

A walkthrough, not just a PDF

We talk your engineers through the findings live. Questions get answered by the person who found the issue, not by a support address.

What you walk away with

1-3 weeks
Typical assessment duration
Every
Finding walked through with your engineers
CERT-In
Aligned methodology (India)

Standards we follow

We don't invent methodology. We follow what auditors actually accept.

CERT-In Guidelines
India
OWASP Top 10
Global · web apps
OWASP API Security Top 10
Global · APIs
NIST SP 800-115
US · technical guide
PTES
Global · pentest standard
CIS Benchmarks
Global · cloud + endpoints

Scoping it properly

What we need from you before we can price it.

The five answers that turn a vague enquiry into a fixed number. If you do not have them, the scoping call exists to work them out with you.

The asset list

Domains, IP ranges, applications, APIs and cloud accounts you want in scope - and just as importantly, anything that must stay out. Third-party SaaS you do not own cannot be tested without the provider’s permission, and we will tell you where that line falls.

Authenticated or not

Unauthenticated testing shows what a stranger sees. Authenticated testing, with real accounts at each privilege level, is where authorisation bypasses and privilege escalation actually surface. The second finds far more and costs more; most estates need both eventually.

What a bad day looks like

Which system, if it were breached, would genuinely hurt - the payments path, the customer database, the admin console. Testing is finite, so it should be weighted toward what you actually cannot afford to lose rather than spread evenly.

Who is driving the deadline

A customer security review, an auditor, an investor, a regulator, or nobody yet. Each produces a different report emphasis, and knowing it up front prevents the classic outcome where the testing was fine but the deliverable does not satisfy whoever asked for it.

Environment: production or staging

Production gives the truest result. Staging is safer but only useful if it genuinely mirrors production - a staging environment with different data, different config or a different WAF will produce findings that do not transfer. We will say which we recommend and why.

What we cannot do

The limits, stated up front.

Four things a pentest is not, which are usually discovered halfway through an engagement with somebody less direct about it.

It is not a certificate

A pentest report is evidence, not an attestation. If your customer needs ISO 27001 or SOC 2, the report supports the programme but the certificate comes from an accredited body or a CPA firm you retain separately.

It is not a guarantee

Testing is time-boxed and bounded by the agreed scope. A clean report means nothing exploitable was found in that surface, in that window, at that skill level. Any firm selling you certainty about the absence of vulnerabilities is selling you something that does not exist.

It does not fix anything by itself

The report changes nothing until somebody ships the remediation. That is why the re-test is included and why we will ask, during scoping, who is going to do the fixing. If the answer is nobody, the testing is premature.

It is not a substitute for the basics

If MFA is not enforced, patching is ad hoc and nobody reviews access, a pentest will tell you that expensively. Those are cheaper to fix than to discover. We will say so rather than write a long report about a short problem.

How an engagement runs

4 phases. Each with a clear deliverable.

You stay informed every step. No mystery-box pentest.

01

Scope + rules

In-scope assets, out-of-scope guardrails, escalation contacts, NDAs. Fixed price for the engagement.

02

Test

1-3 weeks of active testing. Daily check-ins. Critical findings flagged immediately, not at the end.

03

Report + walkthrough

Auditor-ready PDF + executive summary. Live walkthrough of every finding with engineering.

04

Re-test (included)

After your team ships fixes, we re-test for free. Same engineer. No context loss.

After the report

The part most engagements skip.

A pentest report changes nothing on its own. The findings only matter once somebody ships the fix, and that is where most engagements quietly fail: the report is delivered, the invoice is paid, the criticals sit in a backlog behind feature work, and twelve months later the next test finds the same issues. The re-test is included for that reason, and it is the only part of the process that actually moves your risk rather than describing it.

  • Every finding carries a fix, a complexity estimate and a plain-English reason it matters, so whoever prioritises the backlog can weigh it against feature work honestly.
  • Your engineers get a live walkthrough with the person who found the issue. Questions get answered in the room rather than through a support address a week later.
  • We can do the remediation ourselves where you want that, or hand it to your team and stay available for questions. Both are normal; the choice affects the price, not the report.
  • The re-test covers the same scope with the same engineer at no additional cost. What was fixed is confirmed fixed, and what was not is still on the list rather than quietly forgotten.
  • If the same class of finding keeps recurring, that is a process problem rather than a bug, and the retest report will say so. Testing the same estate repeatedly and never asking why is how firms bill for years without improving anything.
Read a full sample report →
The part most engagements skip.

VAPT FAQ

What does a pentest cost?
Fixed-price proposals only, invoiced in your local currency. A one-off pentest typically lands in the equivalent of USD 3k-25k depending on scope - a single web app sits at the bottom of that, a full external plus internal plus cloud assessment at the top. Continuous engagement, meaning quarterly testing plus remediation support, typically runs the equivalent of USD 5k-15k a month. Send a scope and you get a fixed number within two business days.
What actually drives the price?
Surface and depth, not headcount. The number of applications, whether APIs and mobile are included, whether internal testing needs credentialed access, and how many cloud accounts are in scope. A hard deadline raises it, because compressed testing needs more people rather than more weeks. What does not change it is how big your company is.
What is the difference between a vulnerability assessment and a penetration test?
Assessment is breadth - cover everything, find all the known issues, prioritise. Penetration testing is depth - take specific targets and find what an attacker could actually chain together, including business-logic flaws, authorisation bypasses and race conditions that no scanner surfaces. Most buyers are quoted one and expect the other. Tell us which outcome you need and we will tell you which one you are buying.
Are you CERT-In empanelled?
No. We work to CERT-In-aligned methodology - same standards, same deliverables - but we are not an empanelled firm. If your regulator or contract requires an empanelled signature you retain an empanelled firm for the signoff; we hand off cleanly and prepare the documentation pack so their engagement is shorter and cheaper. Buyers without an empanelment mandate generally accept our reports directly.
Whose tools do you use?
Vexta, which we built ourselves, plus manual testing and commercial tooling where it earns its place. Owning the engine means there is no licence markup inside your fee, we can show you the exact check behind any finding, and we can adjust that check when your environment makes it a false positive rather than forwarding your question to a vendor.
Can I see a report before I buy?
Yes, and not a redacted teaser. A complete sample VAPT report is published on the site - executive summary, ranked findings with CVSS and CWE, affected endpoints, reproduction steps and remediation. Read it in full and judge the deliverable rather than the sales page.
How long does an engagement take?
A single web application is about a week. A web app plus API plus supporting infrastructure is about two. A full external, internal, application and cloud assessment runs three to four weeks. Cluster-scale environments are scoped separately. Testing is not the long pole - scheduling and remediation usually are.
Will testing take our systems down?
Testing is non-destructive by default and the rules of engagement are agreed in writing before anything starts, including out-of-scope guardrails, testing windows and an escalation contact. Where a check carries genuine risk to availability we flag it and get explicit approval rather than running it and apologising afterwards.
What happens if you find something critical mid-engagement?
You hear immediately, with enough detail to act. Critical findings are never held back for the report. If it warrants containment before the engagement finishes, we will say so and help.
Is the re-test really included?
Yes, on the same scope, with the same engineer, at no additional cost. It exists because a report that never gets verified does not reduce your risk, it only documents it. The re-test is what turns a list of findings into a change in your actual posture.
Do you do ongoing attack-surface management?
Yes, usually as a retainer combining scheduled Vexta scanning, manual review and a monthly posture report. Point-in-time testing tells you where you were on one day; the retainer exists because most estates drift between assessments and the drift is where the incidents come from.
Same methodology for US and European clients?
Same methodology, region-appropriate standards in the deliverable - NIST SP 800-115, OWASP and CIS for US clients, with HIPAA, PCI-DSS or SOC 2 control mapping where the sector calls for it. The testing does not change; the evidence framing does.

Pentest your stack before someone else does.

Scoping call this week. Findings the next. Re-test included.

Get a quote →