VAPT Cost in India: What Drives Penetration Testing Pricing

A CTO once forwarded me two quotes for the same web application penetration test. One was ninety thousand rupees. The other was six lakh eighty thousand. Same app, same scope on paper. He wanted to know why anyone would pay seven times more for the same word on the invoice. He was asking the wrong question.

The word Vulnerability Assessment and Penetration Testing (VAPT) means almost nothing until you know what the tester is actually doing behind it. One of those quotes was a Nessus scan with a logo on the report. The other was two senior testers spending nine days trying to break authentication, chain business-logic flaws, and pivot into your database. Both are legally allowed to call themselves VAPT. Only one of them will save you when a real attacker turns up.

Price in this market tracks one thing above all others: human hours from people who know what they are doing. Tools are cheap and mostly commoditised. The Nessus, Burp Suite Professional, and Nmap licences that a firm runs cost the same whether the engagement is ninety thousand or six lakh. What you are paying for is the tester who reads the output, discards the false positives, and then goes off-script to find the vulnerability no scanner will ever flag.

That distinction is the whole ballgame. An automated Vulnerability Assessment (VA) tells you which known signatures match your stack. Manual Penetration Testing (PT) tells you whether a determined human can actually get in. A cheap quote is almost always heavy on the first and light on the second. When you compare prices, you are usually comparing two different services that happen to share an acronym.

Numbers first, caveats after. These are 2026 India market ranges for engagements delivered by CERT-In empanelled and comparable firms. They are ranges, not quotes — anyone who prices your environment without asking about endpoint counts, user roles, and integrations is guessing.

A few honest observations from inside these numbers. First, the cheapest web-app quotes you will see — the twenty to forty thousand rupee ones — are almost never manual pentests. They are automated scans with light validation. That is fine if that is genuinely what you need and you know it. It is dangerous if you think you bought an attack simulation and you did not. Second, network testing scales with live hosts, not IP count on paper. A /24 with eight live machines is a very different job from a /24 that is fully populated.

Here is what actually happens on a good scoping call, and it is why two firms can look at the same system and quote so differently. A serious tester will ask you how many distinct user roles exist, whether there is a super-admin, how many API endpoints the app exposes, whether payments run through a gateway or are handled in-house, and whether there is any file upload or document-generation feature. Each answer moves the estimate. Roles multiply the authorisation testing. File uploads open a whole class of attacks. Payment handling drags in PCI DSS scope.

A weak vendor asks for the URL and sends a number the same afternoon. That number is a scanner run. The difference between the two approaches is the difference between a quote and a guess, and you can hear it on the call. If nobody asked you how many roles your application has, nobody is planning to test authorisation properly.

A fintech client had passed three previous pentests, all with clean reports, all under a lakh each. Their platform let users export their own transaction statements as PDFs. Every prior tester had confirmed a logged-in user could only see their own data. True, as far as it went. On day four of our engagement, one of our testers noticed the export endpoint took a numeric document ID in the request body — not tied to the session, just a number. He changed it by one. Out came another customer's full statement: name, account, transactions, the lot.

That is Broken Object Level Authorisation, the number one item on the OWASP API Security Top 10. No scanner finds it, because to the scanner the request looks perfectly valid — authenticated, well-formed, HTTP 200. It takes a human who thinks about business logic and then tries changing a number. The three cheap tests that missed it were not fraudulent. They were just scans. The client had been paying for the word VAPT and receiving a subset of it.

Once a regulator or a framework is involved, the deliverable matters as much as the testing, and that shifts cost. The technical work may be similar, but the reporting rigour, the auditor's credentials, and the certificate you can submit are not interchangeable.

A CERT-In empanelled test is not just a technical audit with a stamp. Empanelment means the firm has been vetted by the Indian Computer Emergency Response Team, follows a prescribed methodology, and can issue the certificate that a bank, a government tender, or a data-localisation requirement will actually accept. If your customer or regulator asks for a CERT-In empanelled auditor and you hand them a report from a non-empanelled vendor, you have paid for a document that does not satisfy the requirement. That is the most expensive mistake in this whole market — paying full price for the wrong credential.

The hidden costs never appear on the low-ball invoice. They arrive later. You get a report full of informational and low findings, no real exploitation, and a false sense of security. Then a breach, a failed audit, or a lost enterprise deal reveals that the test never touched the things that mattered. Now you pay for a proper test anyway, plus incident response, plus the deal you lost while your prospect's security team read your thin report and walked away.

You cannot judge a pentest by the number alone, so ask for the things that reveal what sits behind it. A firm that does serious work will answer these without hesitation. A firm selling a scan will get vague.

If you do only one thing differently on your next VAPT purchase, make it this: stop comparing prices and start comparing effort. Run every quote through the list below.

Back to that CTO with his two quotes seven times apart. The ninety-thousand-rupee scan would have passed his compliance checkbox and missed the authorisation flaw that would have leaked his customers' data. The six-lakh engagement was two senior testers for nine days who would have found it, proven it, and shown him how to fix it. The cheap quote was not cheaper. It was just a smaller amount of money spent on the wrong thing.

VAPT pricing in India is not confusing once you stop treating it as a commodity. It is a straightforward function of human hours, tester skill, scope depth, and the credential you need at the end. Price the effort, not the acronym, and the seemingly wild spread in quotes suddenly makes complete sense.

If you want a second pair of eyes on a scope or a quote before you commit, our CERT-In empanelled auditors at CyberSigma do this work hands-on, day in and day out — and we are happy to tell you honestly whether a number is fair for the job in front of you.