VAPT stands for Vulnerability Assessment and Penetration Testing. The term bundles two genuinely different activities, and most confusion in security procurement comes from treating them as one thing, or worse, buying one while believing you bought the other.
Vulnerability assessment vs penetration testing: the difference
Vulnerability assessment is breadth. Automated tooling enumerates your systems and reports known weaknesses: missing patches, outdated software versions, weak TLS configurations, default credentials, published CVEs. It is fast, repeatable, cheap enough to run continuously, and it produces a long list ranked by severity score.
Penetration testing is depth. A human tester attempts to exploit what exists, chains findings together, and proves impact. It finds the classes of flaw no scanner detects: broken access control between user roles, business logic that lets you skip a payment step, an authorization gap that exposes another tenant’s data.
The distinction in one line: a vulnerability assessment tells you what might be wrong; a penetration test proves what an attacker could actually do.
| Vulnerability assessment | Penetration testing | |
|---|---|---|
| Goal | Find known weaknesses across everything in scope | Prove what an attacker can reach |
| Method | Automated scanning | Human-led exploitation |
| Coverage | Broad, every known CVE | Focused, real attack paths |
| Depth | Surface: versions, patches, configuration | Deep: exploitation, chaining, privilege escalation |
| Output | Ranked list of findings | Proven exploit chains with impact |
| False positives | Common | Validated out |
| Finds logic flaws | No | Yes |
| Frequency | Continuous or monthly | Annual or per release |
| Price with us | From $1,500 per assessment | From $4,000 (API) or $4,200 (external network) |
Why “VAPT” exists as a single term
Because in a mature program you need both, and they answer different questions. The scan gives you coverage across everything you own, catching the unpatched server nobody remembered. The test gives you truth about the systems that matter, catching the flaw that would actually cause a breach.
Run only scanning and you get a comfortable, incomplete picture: hundreds of medium findings and no idea which of them combine into a critical one. Run only annual testing and you are blind for the other fifty-one weeks while your patch levels drift.
The sensible pattern for most organizations:
- Continuous or quarterly vulnerability scanning across the whole estate for breadth and drift detection.
- Annual (or per-release) penetration testing on the systems that hold real risk.
- Retesting after remediation to confirm fixes hold.
What a combined VAPT engagement covers
A well-scoped VAPT engagement typically works through four phases:
1. Reconnaissance and asset discovery. Establish what actually exists, the assets you know about, plus the ones you forgot. Shadow IT and abandoned subdomains are found here.
2. Automated vulnerability assessment. Authenticated and unauthenticated scanning across in-scope hosts and applications, producing the breadth layer.
3. Manual penetration testing. Testers validate which scanner findings are real, then go after what scanners cannot see: authorization boundaries, business logic, chained privilege escalation, and the paths between systems.
4. Reporting and retest. An executive summary for decision-makers, technical detail with reproduction steps for engineers, findings ranked by genuine business impact rather than raw CVSS, and a verification pass once fixes land. The scanning half has its own report format; our vulnerability assessment report template shows each section.
Scope usually spans web applications and APIs, external and internal network infrastructure, cloud configuration, and, where relevant, mobile applications and wireless.
VAPT and compliance
Most frameworks expect both halves, though they rarely use the acronym:
- PCI DSS is the most explicit: Requirement 11.3 mandates quarterly vulnerability scanning (external scans by an ASV), and Requirement 11.4 mandates annual penetration testing, including segmentation testing.
- ISO 27001 expects technical vulnerability management (Annex A 8.8) and evidence that controls are effective, scanning satisfies the former, testing the latter.
- SOC 2 auditors look for a documented vulnerability management process plus independent testing of the systems in your boundary.
- HIPAA requires a risk analysis and periodic technical evaluation; scanning plus testing is how organizations evidence both. Our guide to the HIPAA Security Rule technical safeguards maps what a test evidences for each safeguard in 164.312.
Our compliance pages set out what each framework’s auditors actually ask for, and our vulnerability assessment services cover the scanning half of VAPT on a quarterly or monthly cadence, with analysts validating every finding. When you want both halves in one proposal, our VAPT services scope them together. Our network vulnerability assessment checklist lists the thirty checks that separate a validated assessment from a scanner export.
What VAPT costs
Pricing tracks scope and depth, and the two halves are priced very differently. Vulnerability scanning is cheap and often subscription-based, a flat rate per scan or per asset. Penetration testing is priced on tester time against a defined scope.
Our published prices:
| Component | Price | What sets it |
|---|---|---|
| Vulnerability scan or assessment | $1,500 up to 250 devices, $2,500 up to 1,000 | Device count; larger estates quoted |
| API penetration test | From $4,000 | Endpoints and roles |
| External network penetration test | From $4,200 | Live internet-facing hosts |
| Web application penetration test | From $5,200 | Roles and application size |
| Internal network penetration test | From $6,000 | Hosts, sites and domains |
Every penetration test price is fixed in writing before work begins and includes a free retest of remediated findings. Quarterly or monthly scanning runs as a recurring vulnerability management program, billed at the same per-scan prices.
That difference is exactly where buyers get exploited. A “VAPT” quote dramatically below market is almost always scanning with a report template, sold at penetration-testing prices. Before comparing quotes, ask what proportion of the engagement is manual and who performs it, the checklist in our guide to choosing a penetration testing company applies directly. Our pricing page shows both models priced separately and transparently.
How to decide what you need
Start with vulnerability scanning if you have no current visibility, a large or unmapped estate, or an immediate compliance deadline for quarterly scanning. It is the cheapest way to find the obvious problems fast.
Go straight to penetration testing if you have a specific high-value application, an enterprise customer or auditor demanding independent testing, or you already run scanning and keep finding the same low-severity noise.
Buy both, as a program, if you hold sensitive data at scale, operate under PCI DSS or a similar regime, or have reached the point where “we scanned it” no longer satisfies the people asking.
For networks specifically, our guide to network security assessment compares the options from a validated scan to a full attack test, and what each one costs.
Frequently asked questions
What is the difference between vulnerability assessment and penetration testing? A vulnerability assessment finds and ranks known weaknesses across many systems. A penetration test takes the systems that matter, exploits what it finds, and proves what an attacker could reach. Our guide to penetration testing vs vulnerability scanning covers the scanning side of that comparison in more detail.
Is VAPT the same as a penetration test? No. VAPT is both activities together. A quote labeled VAPT that contains no manual testing is a vulnerability assessment.
How often should VAPT be done? Vulnerability assessments quarterly or monthly, and after significant changes. Penetration testing at least once a year and after major releases. PCI DSS sets the same split: scans every three months, penetration tests every twelve.
What does VAPT stand for? Vulnerability Assessment and Penetration Testing: one engagement that combines a vulnerability assessment with a penetration test, scoped and reported together.
The short version
VAPT is not a product, it is the combination of breadth (automated assessment) and depth (human testing), and the value comes from running both deliberately rather than buying one and assuming it covers the other. Scanning keeps you honest month to month. Penetration testing tells you what an attacker could actually achieve.
If you want the combination scoped properly against your environment, scanning for coverage, manual testing where the real risk sits, scope an assessment and we will build it around what you actually run, at a fixed price with a free retest included.
Written by
Invadel Team
Senior penetration testers writing from real engagements, the same team that scopes, tests, and reports for our clients. About Invadel →