VAPT stands for Vulnerability Assessment and Penetration Testing. A vulnerability assessment finds and ranks weaknesses in systems. A penetration test goes further and actively tries to exploit them, to show whether an attacker could get in. An auditor does not repeat the test. The auditor reads the report and checks that the scope was right, the tester was independent, and the findings were fixed.
Last reviewed: 17 October 2026. Facts checked. We opened NIST's glossary pages for "penetration testing" and "vulnerability assessment", the NIST page for SP 800-115 (abstract only), and the full text of CERT-In's Comprehensive Cyber Security Audit Policy Guidelines, Version 1.0, dated 25 July 2025. We did not open RBI, SEBI or IRDAI circulars, so we state no sector-specific VAPT duty here. We did not open the full text of NIST SP 800-115.
What each half means
The two words in VAPT describe two different jobs.
| Vulnerability assessment | Penetration test | |
|---|---|---|
| Question it answers | What weaknesses exist? | Can someone actually exploit them? |
| Method | Scans and examination of systems | Active testing that mimics an attacker |
| Output | A list of weaknesses, ranked by severity | Proof of what could be reached, with steps |
| Depth | Wide | Narrow and deep |
NIST defines a vulnerability assessment as a systematic examination of an information system or product to determine the adequacy of security measures and identify security deficiencies. NIST defines penetration testing as security testing in which evaluators mimic real-world attacks to find ways to get around security features.
CERT-In's 2025 guidelines use similar words. They describe penetration testing as testing in which components or the whole application are actively tested to identify and exploit weaknesses, to see whether data or the underlying environment could be compromised.
Types of VAPT you will see in scope documents
CERT-In's guidelines list audit types an engagement may name, including:
- VAPT in general
- External attack penetration testing (EAPT)
- Device level audit
- Configuration audit
- Web application security audit
- Mobile application security audit
- API security audit
The scope document must say which type is being done. A "VAPT" of the website tells you nothing about the finance system. Always read the asset list.
How a VAPT engagement runs
NIST's SP 800-115 is a guide to planning and carrying out technical security tests, analysing the findings and planning fixes. In practice, an engagement runs in this order:
- Agree the scope. Which systems, which dates, which methods are allowed.
- Scan and discover. The tester finds systems and known weaknesses.
- Attack (penetration test only). The tester tries to exploit what was found, inside the agreed rules.
- Report. Findings, severity, evidence and fix advice.
- Fix and retest. The company closes the findings and the tester confirms.
CERT-In's guidelines say the auditing organisation must tell the auditee, before work starts, the type of audit, the report format, the standards used, the assets covered, how auditee data is handled and kept, the timeline, and whether audit metadata goes to CERT-In. They also say follow-up audits should be part of the engagement.
What a good VAPT report contains
- Scope, with the asset list and the date it was last updated
- Method and standards used
- Each finding with severity, the affected asset and proof
- Fix advice for each finding
- An executive summary for management
- Retest results, where done
CERT-In's guidelines say the scope should come from an updated asset inventory. An old inventory means a test that missed systems.
How an auditor uses the report
The auditor treats the report as evidence about IT controls. We suggest these checks:
| Check | Why it matters |
|---|---|
| Does the scope cover the systems that hold financial data? | A test of the wrong systems proves little |
| Is the tester independent of the team that built or runs the systems? | Independence gives the report weight |
| Is the report recent enough to cover the audit period? | Old reports do not describe today's systems |
| Are critical findings closed, with a retest? | Open critical findings are a control gap |
| Did management review the report and approve a fix plan? | Shows governance, not just testing |
The auditor should also ask who owns each open finding and by what date it will be fixed. A report with no owners and no dates is a warning sign.
What VAPT does not prove
A clean VAPT does not mean the company is secure. It tests one moment and one scope. It says little about staff behaviour, vendor risk or business-process controls. For the wider picture, see our guide on how IT audit, ITGC audit and cyber security audit differ.
CERT-In's guidelines say a cyber security audit should be conducted at least once a year, and that sector regulators may raise the frequency. We read this as the guidelines' own expectation. Check whether your regulator sets a different rule.
Our ITGC audit workbook is a free place to record which IT controls you tested and what evidence you kept.
Frequently Asked Questions
Is VAPT the same as a cyber security audit?
No. VAPT is one technical test inside a wider cyber security audit. The audit also reviews policies, access, processes and governance.
Who can perform VAPT?
CERT-In keeps a list of empanelled information security auditing organisations. Whether you need one depends on your regulator or contract. Check the requirement that applies to you.
How often should VAPT be done?
CERT-In's 2025 guidelines say a cyber security audit should happen at least once a year. Many companies also retest after major changes.
Is a vulnerability scan the same as a penetration test?
No. A scan lists possible weaknesses. A penetration test tries to exploit them and shows real impact.
What should an auditor ask for?
The signed report, the scope and asset list, the tester's independence confirmation, the fix tracker and the retest result.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error