VAPT Cost in India 2026 — Web App, Network & Mobile Pricing Guide
One of the most common questions Indian IT and security managers ask before signing a contract is: how much does VAPT cost in India? The honest answer is that pricing varies widely — a basic web application VAPT can start at ₹25,000, while a comprehensive enterprise engagement covering networks, applications, APIs, and cloud infrastructure can exceed ₹5 lakh. This guide breaks down real 2026 market pricing for every VAPT type so you can budget accurately and avoid being overcharged — or worse, buying an inadequate assessment.
What Is VAPT and Why Does It Matter in 2026?
Vulnerability Assessment and Penetration Testing (VAPT) is a two-phase security evaluation. The vulnerability assessment phase uses automated and manual techniques to identify security weaknesses across systems. The penetration testing phase goes further — a skilled tester attempts to exploit those weaknesses to determine their real-world impact.
In 2026, VAPT is no longer optional for most Indian businesses. The RBI Cybersecurity Framework mandates annual penetration testing for banks and NBFCs. CERT-In’s 2022 directions require covered entities to conduct periodic security audits. ISO 27001 certification requires documented vulnerability management. And enterprise clients — particularly in BFSI, healthcare, and government — now routinely demand VAPT reports before vendor onboarding.
VAPT Pricing in India: 2026 Ranges by Type
1. Web Application VAPT
Web application VAPT is the most commonly procured service, covering business websites, SaaS platforms, customer portals, and internal web tools. Testing typically follows OWASP Top 10 methodology and covers authentication, authorization, input validation, session management, API security, and business logic flaws.
- Small web app (5–15 pages, basic auth): ₹25,000 – ₹60,000
- Medium web app (e-commerce, SaaS, 15–50 endpoints): ₹60,000 – ₹1,50,000
- Large web app (complex roles, 50+ endpoints, APIs): ₹1,50,000 – ₹2,50,000
- Enterprise / multi-tenant SaaS platform: ₹2,50,000 – ₹5,00,000+
2. Network VAPT (Internal and External)
Network VAPT assesses your infrastructure — routers, firewalls, switches, servers, and endpoints — for misconfigurations, unpatched vulnerabilities, weak credentials, and lateral movement paths. External network VAPT simulates an internet-facing attacker; internal VAPT simulates a threat already inside your perimeter.
- External network VAPT (up to 10 IPs): ₹50,000 – ₹1,20,000
- Internal network VAPT (up to 50 hosts): ₹80,000 – ₹2,00,000
- Full network VAPT (100–500 hosts, internal + external): ₹2,00,000 – ₹5,00,000
- Large enterprise network (500+ hosts, multiple sites): ₹5,00,000 – ₹12,00,000+
3. Mobile Application VAPT
Mobile VAPT covers Android and iOS applications, assessing client-side storage, API communication, authentication tokens, deep links, and binary protections. Testing follows OWASP Mobile Application Security Verification Standard (MASVS).
- Single platform (Android or iOS), basic app: ₹40,000 – ₹80,000
- Both platforms (Android + iOS): ₹70,000 – ₹1,50,000
- Complex fintech or healthcare mobile app: ₹1,50,000 – ₹3,00,000
4. API Security Testing
As microservices architectures proliferate, API security testing has become a standalone service. Testers assess REST, GraphQL, and SOAP APIs for broken authentication, excessive data exposure, lack of rate limiting, and injection flaws.
- Up to 20 API endpoints: ₹30,000 – ₹80,000
- 20–100 endpoints: ₹80,000 – ₹2,00,000
- Large API surface (100+ endpoints): ₹2,00,000 – ₹4,00,000
5. Cloud Security Assessment
Cloud VAPT reviews your AWS, Azure, or GCP configuration for identity and access management (IAM) misconfigurations, exposed storage buckets, insecure network security groups, and weak logging posture.
- Single cloud environment (basic): ₹60,000 – ₹1,50,000
- Multi-cloud or complex environment: ₹1,50,000 – ₹4,00,000
6. Thick Client / Desktop Application VAPT
- Standard desktop application: ₹50,000 – ₹1,50,000
- Complex ERP or trading application: ₹1,50,000 – ₹3,50,000
What Factors Affect VAPT Cost in India?
1. Scope and Attack Surface
The number of IP addresses, URLs, endpoints, user roles, and integrations directly determines the effort required. A single-role login portal is vastly simpler than a multi-tenant SaaS platform with admin, staff, and customer roles.
2. Testing Methodology
Black box testing (no prior knowledge) is fastest and least expensive. White box testing (full access to source code, architecture diagrams) takes longer but finds deeper vulnerabilities. Grey box (limited credentials, partial documentation) sits in between. For compliance-driven assessments, grey or white box is typically required.
3. Vendor Reputation and CERT-In Empanelment
CERT-In empanelled security auditors — those verified by India’s national cybersecurity agency — command a premium, typically 20–40% above non-empanelled vendors. This premium is justified: empanelled firms have demonstrated qualified staff, documented methodologies, and government oversight. For regulatory submissions (RBI, SEBI, IRDAI, CERT-In itself), reports from non-empanelled vendors may not be accepted.
4. Re-testing / Remediation Verification
Most VAPT engagements include one round of re-testing after you fix identified vulnerabilities. Some vendors charge separately for re-testing (₹15,000–₹80,000), while others bundle it. Always confirm whether re-testing is included before signing.
5. Report Quality
A compliance-grade VAPT report includes an executive summary, technical findings with CVSS scores, proof-of-concept evidence, remediation recommendations, and a remediation tracker. Vendors who deliver only automated scanner output in a PDF are not providing real VAPT — they are providing a vulnerability scan.
6. Turnaround Time
Standard engagements deliver reports in 10–15 business days. Expedited delivery (5–7 days) or continuous VAPT engagements cost 30–50% more.
VAPT Pricing Comparison Table — India 2026
| VAPT Type | Scope | Price Range (INR) | Typical Duration |
|---|---|---|---|
| Web Application | Small (up to 15 pages) | ₹25,000 – ₹60,000 | 3–5 days |
| Web Application | Medium (15–50 endpoints) | ₹60,000 – ₹1,50,000 | 5–10 days |
| Web Application | Large / Enterprise | ₹1,50,000 – ₹5,00,000+ | 10–20 days |
| Network VAPT | Up to 50 hosts | ₹80,000 – ₹2,00,000 | 5–10 days |
| Network VAPT | 100–500 hosts | ₹2,00,000 – ₹5,00,000 | 10–20 days |
| Mobile App (Android + iOS) | Standard | ₹70,000 – ₹1,50,000 | 5–8 days |
| API Security | Up to 20 endpoints | ₹30,000 – ₹80,000 | 3–5 days |
| Cloud Assessment | Single environment | ₹60,000 – ₹1,50,000 | 5–8 days |
What Is Included in a VAPT Engagement?
A professionally delivered VAPT engagement from a CERT-In empanelled firm should include:
- Pre-engagement scoping call and signed Rules of Engagement (RoE)
- Reconnaissance and threat modelling
- Automated vulnerability scanning (Nessus, Burp Suite, Nmap, etc.)
- Manual exploitation and business logic testing
- Detailed technical report with CVSS v3.1 scoring
- Executive summary suitable for board-level reporting
- Remediation recommendations with effort estimates
- One round of re-testing after remediation
- Compliance attestation letter (if required for regulatory submissions)
Red Flags When Evaluating Cheap VAPT Vendors
- No scoping call: Legitimate VAPT requires understanding your architecture before pricing.
- Fixed price for everything: A vendor quoting ₹10,000 for any web application VAPT is delivering automated scans, not penetration testing.
- No CERT-In empanelment: Verify at cert-in.org.in. Non-empanelled vendors cannot produce reports accepted by RBI, SEBI, or government bodies.
- No Rules of Engagement document: Untested systems without RoE create legal and operational risk.
- Report delivered in less than 2 days: Genuine manual penetration testing of even a small web app takes 3–5 days minimum.
- No re-test included: Without re-testing, you cannot confirm vulnerabilities are actually fixed.
- Automated scanner output delivered as a VAPT report: Look for manual proof-of-concept evidence in the report.
How to Choose the Right VAPT Vendor in India
When evaluating vendors, ask these questions:
- Are you CERT-In empanelled? Can I verify this at cert-in.org.in?
- What certifications do your testers hold (OSCP, CEH, CREST, GPEN)?
- Can you provide a sample redacted report from a similar engagement?
- Is re-testing included in the price?
- What is your disclosure and escalation procedure if we find a critical vulnerability?
- Can you provide a compliance attestation letter accepted by RBI/SEBI/CERT-In?
How MDIT Services Prices VAPT
MDIT Services is a CERT-In empanelled cybersecurity company headquartered in New Delhi, with pan-India delivery capability and over 200 clients across BFSI, healthcare, IT, government, and manufacturing sectors. Our VAPT pricing is transparent and scope-based — we do not charge flat fees that ignore your actual attack surface.
All MDIT VAPT engagements include:
- Pre-engagement scoping and Rules of Engagement
- Manual testing by OSCP/CEH-certified engineers
- OWASP and PTES-aligned methodology
- Compliance-grade report accepted by RBI, SEBI, IRDAI, and CERT-In
- One complimentary re-test cycle
- Post-report remediation advisory call
Get a Free VAPT Quote
Contact MDIT Services for a transparent, scoped quotation. Share your application type, number of endpoints or IP addresses, and compliance requirement, and our team will provide a detailed proposal within 24 hours.
Visit: mditservices.in/contact | Email: info@mditservices.in | Call: +91-11-XXXX-XXXX
