VAPT Services in Bangalore for Startups & Enterprises
Most VAPT reports we are asked to review in Bangalore have one thing in common: they were never meant to be read. They were meant to be attached. A procurement team needed a PDF before onboarding a client, a compliance lead needed evidence before an audit, and somewhere a vendor obliged with a scan, a template, and an invoice. The findings sat untouched until the day someone actually got breached.
VAPT stands for Vulnerability Assessment and Penetration Testing. The two halves are not the same exercise, and the gap between a scan dressed up as a pentest and a genuinely adversarial test is where most Bangalore startups quietly carry risk they have already paid to remove. This piece is about closing that gap: what the two activities actually are, why a SaaS or fintech company in this city cannot skip them, what a real engagement looks like from the inside, and how to tell a senior-led partner from a report factory.
The scan-and-pentest confusion that costs you a real test
A vulnerability assessment is breadth. You point a scanner such as Nessus, Qualys, or OpenVAS at an IP range or an application, and it tells you which known vulnerabilities are present against a signature database. It is fast, largely automated, and useful for hygiene. It also lies by omission. A scanner will happily report a TLS misconfiguration and completely miss a broken access control that lets one tenant read another tenant's data, because that flaw only exists in your business logic and no signature exists for it.
Penetration testing is depth. A human tries to break in the way an attacker would: chaining a low-severity information disclosure into an authentication bypass, abusing a password reset flow, escalating from a normal user to an admin, pivoting from one microservice to the database. The tooling is the same, but the intent and the creativity are not. If your vendor delivered a 40-page report in three days and every finding maps cleanly to a CVE number, you bought an assessment and were charged for a test.
| Dimension | Vulnerability Assessment | Penetration Test |
|---|---|---|
| Primary mode | Automated scanning | Human-led exploitation |
| Finds | Known, signature-based flaws | Logic flaws, chained attacks, privilege escalation |
| Typical duration (mid-size SaaS app) | 1-2 days | 6-15 days |
| False positives | High, needs triage | Low, findings are proven exploitable |
| Answers | What is potentially vulnerable | What an attacker can actually do |
You need both. The assessment gives you coverage and a hygiene baseline. The penetration test tells you which of those findings a real adversary would use to reach your data. A partner who cannot articulate this distinction in the kickoff call is a partner who will scan and call it a day.
Why Bangalore's companies cannot treat this as optional
Bangalore is dense with the exact profiles regulators and enterprise buyers scrutinise hardest: SaaS platforms holding other companies' data, fintech and lending apps touching payments, health-tech handling patient records, and B2B software selling into banks and insurers. Each of these sits under a specific compliance driver, and most founders discover the requirement not from a regulator but from a customer's security questionnaire that stalls a deal.
The drivers that actually force the test
- RBI directives for regulated entities and their technology service providers require periodic VAPT; if you build software for a bank or an NBFC, their auditors will ask for your report and the closure evidence.
- The CERT-In directions of April 2022 mandate that entities report specified cyber incidents within six hours and maintain security practices; enterprise clients increasingly demand a CERT-In empanelled auditor's report as proof.
- PCI DSS applies the moment you store, process, or transmit cardholder data; Requirement 11.3 mandates internal and external penetration testing at least annually and after significant change, and requirement 11.4 covers segmentation testing.
- The Digital Personal Data Protection Act, 2023 (DPDP Act) obliges you as a Data Fiduciary to implement reasonable security safeguards; a documented VAPT programme is a primary way to show you took them.
- SOC 2 and ISO/IEC 27001 audits, which most Bangalore SaaS firms pursue to close enterprise deals, both expect evidence of regular technical testing under their control frameworks.
Notice what these have in common. None of them cares whether you feel secure. They care whether you can produce evidence of a competent test and evidence that you fixed what it found. A pretty report with no remediation trail fails every one of them.
What a real engagement looks like from the inside
Here is a scene from a lending-app assessment, details changed. Day one, the client hands over two test accounts and a Postman collection. The scanner run is clean-ish, a handful of medium findings, nothing that would frighten anyone. The founder is relieved and mentally closes the ticket.
Day four is different. The tester notices the loan-application endpoint accepts an applicant ID in the request body but only checks that the caller is authenticated, never that the caller owns that ID. Change the number, and you are reading another borrower's PAN, bank details, and sanctioned amount. That is a broken object-level authorisation flaw, the top item on the OWASP API Security Top 10, and no scanner on earth would have flagged it because to the tool it looks like a perfectly valid authenticated request. The tester writes the same ID as a mass-enumeration script, proves thousands of records are exposed, and the medium-severity report becomes a critical one overnight.
That is the difference you are paying for. Not the tool, the human who thought to change the number. A structured engagement follows a recognised methodology so this thinking is systematic rather than lucky.
The methodology, phase by phase
| Phase | What happens | Artefact you should receive |
|---|---|---|
| Scoping | Define targets, environment, rules of engagement, test windows | Signed scope and authorisation document |
| Reconnaissance | Map the attack surface, endpoints, subdomains, tech stack | Attack-surface inventory |
| Vulnerability analysis | Automated scanning plus manual review against OWASP Top 10, ASVS, WSTG | Triaged findings list |
| Exploitation | Prove impact by chaining and exploiting findings safely | Proof-of-concept evidence per finding |
| Post-exploitation | Assess how far an attacker could pivot and what data is reachable | Impact narrative |
| Reporting | Rate by CVSS, write reproducible steps and fixes | Technical and executive report |
| Retesting | Verify each fix after remediation | Closure certificate |
Two of those phases are where cheap vendors cut corners. Manual vulnerability analysis, because it is slow and needs skill. And retesting, because it means coming back after you have done the work. A test without a retest leaves you with a list of open findings and no proof they were ever closed, which is exactly the evidence gap that fails a PCI QSA or an RBI auditor.
The five ways a Bangalore VAPT goes wrong
After enough reviews, the failure modes repeat. If your last engagement did any of these, you did not get a test worth the name.
- The report is a scanner export with a logo. Every finding has a CVE and a CVSS but no attempt to prove it is exploitable in your specific context, and no business-logic findings at all.
- The scope was quietly narrowed to fit the price. Your APIs, mobile app, and internal network were out of scope, so the test covered the least interesting third of your attack surface.
- There is no retest. You fixed the criticals, but nobody verified the fix, so your closure evidence is your own word.
- The testing hit production without safeguards, or hit a staging environment so different from production that the results do not transfer.
- The credentials given were a single low-privilege user, so no privilege-escalation or authorisation testing was possible; the tenant-isolation flaw that would sink you was never in reach.
What it costs, and what the numbers should tell you
Prices in Bangalore vary widely, and a suspiciously low quote is itself a finding. Genuine manual penetration testing is priced on person-days of skilled effort, so the number tracks the scope and the seniority of the tester, not a fixed menu. The ranges below are indicative for the Indian market in 2026 and assume real manual testing, not a scan.
| Engagement type | Indicative scope | Typical INR range | Effort |
|---|---|---|---|
| Web application VAPT | One app, authenticated, moderate complexity | INR 90,000 - 2,50,000 | 6-12 days |
| API VAPT | REST/GraphQL, 30-60 endpoints | INR 1,00,000 - 3,00,000 | 6-12 days |
| Mobile app VAPT | Android or iOS, with backend | INR 1,20,000 - 3,00,000 | 7-14 days |
| External network VAPT | Internet-facing IPs and services | INR 60,000 - 1,80,000 | 4-10 days |
| Cloud configuration review | AWS/Azure/GCP posture | INR 80,000 - 2,50,000 | 5-12 days |
A quote of INR 20,000 for a full web application penetration test is not a bargain; it is arithmetic telling you no human will spend meaningful time on your system. At that price the vendor can afford one day, and one day buys you a scan. Read the price as a statement of how much attention you will receive, because that is precisely what it is.
Choosing a senior-led partner, not a report factory
The market is crowded and the reports look identical until you read them. These are the questions that separate the two, and you should ask them before you sign, not after.
Questions that reveal the truth
- Who exactly is testing my system, and what is their experience? You want a named senior tester, not an anonymous pool. Ask whether the person holds OSCP, CREST, or equivalent and how many years they have done this hands-on.
- Are you CERT-In empanelled? For any report you will show to a regulator or an enterprise client, empanelment is often the difference between the report being accepted and being rejected.
- Show me a sample report with the findings redacted. A good report has reproducible steps, real proof-of-concept evidence, and remediation advice specific to your stack, not a paragraph copied from OWASP.
- Is retesting included, and do you issue a closure certificate? If it is a paid extra or absent, your compliance evidence is incomplete.
- How much of the test is manual? If the honest answer is mostly automated, you are buying an assessment.
- What is your incident-reporting posture under the CERT-In directions if you find something actively exploited? A serious firm has thought about this.
| Signal | Report factory | Senior-led partner |
|---|---|---|
| Team | Anonymous, junior-heavy | Named senior tester, verifiable |
| Findings | CVE list, no logic flaws | Chained, business-logic, proven |
| Turnaround | Same week, any scope | Timed to real effort |
| Retest | Extra cost or absent | Included, with closure certificate |
| Compliance fit | Generic template | Mapped to RBI/PCI/DPDP as needed |
A fix-it checklist before you commission your next test
Whether you renew with your current vendor or move, run this list first. It costs you nothing and it forces the scope to reflect your actual risk.
- Inventory your real attack surface: every public API, subdomain, mobile app, admin panel, and third-party integration, and put all of it in scope.
- Provide test accounts at multiple privilege levels so authorisation and tenant-isolation testing is actually possible.
- Decide production versus staging deliberately, and if staging, confirm it mirrors production configuration and data shape.
- Write down which compliance driver this test must satisfy (RBI, PCI DSS 11.3/11.4, DPDP, SOC 2, ISO 27001) so the report maps to it.
- Insist on a signed rules-of-engagement and authorisation document before any packet is sent.
- Require reproducible proof-of-concept evidence per finding, CVSS ratings, and remediation steps specific to your stack.
- Book the retest and the closure certificate as part of the same engagement, not a future afterthought.
- Assign an internal owner for remediation and set closure deadlines by severity before the report arrives, not after.
The reports that go untouched all started the same way: as an attachment someone needed, not a test someone wanted. Flip that intent and everything downstream changes. Scope for your real attack surface, insist on a human who will change the number in the request, and treat the retest as the point of the exercise rather than an upsell. A VAPT done this way stops being a PDF you file and becomes the reason a breach that could have happened, did not.
If you would rather have that conversation with a senior tester than a sales template, CyberSigma is a CERT-In empanelled team that does this work hands-on, in Bangalore and across India, and we are happy to walk through your scope before you commit to anything.
FAQs
What is the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment is mostly automated scanning that finds known, signature-based flaws across a broad surface. A penetration test is human-led exploitation that proves what an attacker can actually do, including business-logic and authorisation flaws no scanner detects. You need both, but only the pentest tells you your real exposure.
How long does a VAPT take for a typical Bangalore SaaS application?
A genuine manual web or API penetration test for a moderately complex application usually runs 6 to 15 working days, plus a remediation window and a retest. Anything delivered in two or three days for a full app is a scan, not a test.
Do I legally need VAPT in India?
It depends on your sector. RBI-regulated entities and their technology providers, anyone under PCI DSS, and Data Fiduciaries under the DPDP Act all face effective requirements for security testing. Even where no law names VAPT explicitly, enterprise clients and SOC 2 or ISO 27001 audits will demand the report and its closure evidence.
Why does CERT-In empanelment matter when choosing a provider?
CERT-In empanelment means the government has vetted the firm's security-audit capability. For any report you will present to a regulator or a large enterprise buyer, an empanelled auditor's report is far more likely to be accepted, and it signals the testing meets a recognised standard.
How much should a VAPT cost in Bangalore?
Real manual testing is priced on skilled person-days. Indicatively, a web application test runs roughly INR 90,000 to 2,50,000 and an API or mobile test somewhat higher. A quote around INR 20,000 for a full pentest simply means no human will spend meaningful time on your system.
What should a good VAPT report contain?
Reproducible steps for each finding, proof-of-concept evidence that the flaw is genuinely exploitable in your context, CVSS severity ratings, remediation advice specific to your technology stack, an executive summary for leadership, and a retest with a closure certificate confirming each fix was verified.
Liked the post? Share on:
Leave A Comment