Overview
Several US rules pair the two activities. Covered institutions under the FTC Safeguards Rule that lack continuous monitoring owe a yearly penetration test plus a vulnerability assessment every six months or sooner, while PCI DSS expects quarterly scans alongside yearly testing. A combined VAPT gives you the wide view and the proof of exploitability in one report, though PCI external scans must still come from an Approved Scanning Vendor.
VAPT is the term most buyers, tenders and procurement checklists use when they ask for a pentest, and it describes a deliberate pairing of two activities. The vulnerability assessment casts a wide net, using automated tooling to enumerate the full surface and flag known weaknesses across many systems quickly. The penetration test then goes deep, with testers manually confirming what is real, discarding false positives, and exploiting the issues that matter to show genuine impact.
The combination exists because neither half is sufficient alone. An assessment on its own produces a long, noisy list that still needs human judgment and tends to miss anything requiring logic or chaining. A pentest on its own gives depth but, within a fixed budget, less breadth of coverage. Together they give you both: confidence that the whole scope was examined, and proof of which findings an attacker could actually use. This is why VAPT is the default request in so many contracts.
We deliver it as one engagement with one report. The assessment runs first to map the surface and surface candidate issues; our testers then verify and exploit by hand, so what reaches you is confirmed rather than raw. Findings are scored with CVSS v4.0, prioritized by real risk, and written for both executives and engineers. Critical issues are raised the moment we confirm them, and fixed findings are retested free of charge.
How US engagements run
- Delivered remotely from India, 9.5 hours ahead of US Eastern in US daylight time and 10.5 hours in winter; calls and testing windows are set around your time zone at scoping
- Fixed-price proposals in US dollars, with scope, dates and the free retest written in before any work begins
- Written authorization signed by someone with authority over every target, because the federal Computer Fraud and Abuse Act and state laws make permission the dividing line
- Reports that name the requirement a test supports, such as PCI DSS 11.4, the FTC Safeguards Rule or SOC 2, without claiming a QSA, ASV or C3PAO role we don't hold
What's included
Our approach
- Scope & authorizationWe agree the full scope and obtain written authorization to test it.
- AssessmentAutomated enumeration and scanning establish coverage and candidate issues.
- Manual testingTesters verify, exploit and chain the findings that carry real risk.
- Rating & triageConfirmed findings are scored and prioritized for remediation.
- Report & debriefOne risk-rated report is delivered and walked through with your team.
What you receive
- Single report covering assessment and penetration test
- Verified, risk-rated findings with CVSS v4.0 scores
- False positives removed before the report reaches you
- Remediation guidance for executives and engineers
- Free retest of fixed issues and an attestation letter
Standards & frameworks
- PTES
- NIST SP 800-115
- OWASP WSTG
- OWASP ASVS
- MITRE ATT&CK
- CVSS v4.0
- CWE
- FTC Safeguards Rule
- NYDFS Part 500
- CMMC Level 2
Frequently asked questions
Is VAPT different from a penetration test?
It is a penetration test with an explicit vulnerability-assessment stage bundled in, which is how most contracts phrase the requirement. In practice our pentests already include that breadth-first step, so asking for VAPT or a pentest usually gets you the same engagement.
What can VAPT cover?
Any scope we test: web and mobile applications, APIs, external and internal networks, cloud and more, singly or combined. We shape the assessment and testing effort to the surface involved, so a web VAPT and a network VAPT look quite different under the same name.
Why not just run a vulnerability scan?
A scan lists potential issues from signatures and leaves triage to you, including the false positives. VAPT adds the manual testing that confirms what is exploitable, finds the logic and chained flaws a scan cannot, and gives you findings you can act on with confidence.
Which US rules call for annual penetration testing?
Among others: PCI DSS v4.0.1 Requirement 11.4; the FTC Safeguards Rule for covered non-bank financial institutions that don't run continuous monitoring; and NYDFS Part 500.5 for covered entities. HHS has proposed annual testing under HIPAA, but that rule is not final. Confirm which apply to you with counsel.
Can you act as our CMMC assessor or PCI QSA?
No. We don't claim QSA, ASV, C3PAO or RPO status. We run the penetration test and document it for whoever assesses you. If a requirement calls for an accredited body, raise it at scoping and we'll tell you plainly whether we can meet it.