Two VAPT quotes for “the same” application can differ several times over — usually because they are not quoting the same thing. Here is what really moves the price and the timeline, and how to make quotes comparable.
Vendors price by different units — per application, per endpoint, per IP, per day — so the scope behind each number differs.
Surface, depth, methodology, environment, retesting and who must sign the report.
From scoping to retest, and what stretches or shortens each phase.
Vulnerability Assessment and Penetration Testing (VAPT) has no list price, in India or anywhere else. Cost follows scope and depth: how much there is to test, how deeply it is tested by people rather than tools, and what the report has to satisfy. Once you can see those levers, comparing quotes becomes straightforward.
One vendor prices per application, another per API endpoint, a third per IP address or per testing day. A low quote may cover an automated scan of the login page; a higher one may include authenticated, role-by-role manual testing of every workflow plus a retest. Neither number means anything until you know the scope behind it.
As a starting point, VVnT SeQuor’s VAPT for a small application starts from INR 1,50,000 — for example, a single web application with a limited number of user roles and API endpoints. Larger scopes (multiple applications, mobile apps, extensive APIs, infrastructure or cloud) are quoted after a scoping call, against the six drivers above.
A focused engagement on a single web application with a few user roles typically needs one to two weeks of testing, plus reporting. Multi-application scopes with APIs, mobile apps and infrastructure commonly run three to six weeks. Add time before testing for scoping and access set-up, and after it for remediation by your team and a retest — that remediation window is usually the longest part of the calendar.
If your regulator, a government buyer or a contract requires a CERT-In empanelled auditor, confirm that before you scope. VVnT SeQuor’s assessments follow CERT-In guidelines and processes. Where a regulator or buyer requires the audit to be performed by a CERT-In empanelled organisation, we deliver it together with CERT-In empanelled partners from our partner ecosystem.
Write one scope sheet — assets, roles, environments, reporting format, retest expectations — and send the same sheet to every vendor. Our free Pre-VAPT Readiness / Scoping Checklist gives you that structure.
Cost depends on scope. As an indicative starting point, VVnT SeQuor’s VAPT for a small application starts from INR 1,50,000; larger scopes are quoted after scoping. Across vendors, cost is driven by the assets in scope, testing depth, reporting format, retest rounds and whether a CERT-In empanelled auditor is required — so send every vendor the same written scope.
A single web application with a few roles typically needs one to two weeks of testing plus reporting; larger scopes covering APIs, mobile and infrastructure commonly take three to six weeks, plus time for remediation and a retest.
No. A scan is one input. A VAPT adds manual testing that confirms exploitability, tests business logic and access control across roles, and documents evidence for each finding.
Only where a regulator, government buyer or contract requires it. VVnT SeQuor’s assessments follow CERT-In guidelines and processes. Where a regulator or buyer requires the audit to be performed by a CERT-In empanelled organisation, we deliver it together with CERT-In empanelled partners from our partner ecosystem.