Overview
UK buyers meet the term VAPT more and more in supplier questionnaires and overseas parent-company policies. In practice it means coverage plus depth: a full vulnerability sweep across agreed hosts and applications, followed by manual testing of the issues that matter. We remove false positives before you see them, so the report lists only confirmed weaknesses.
VAPT is the term most buyers, tenders and procurement checklists use when they ask for a pentest, and it describes a deliberate pairing of two activities. The vulnerability assessment casts a wide net, using automated tooling to enumerate the full surface and flag known weaknesses across many systems quickly. The penetration test then goes deep, with testers manually confirming what is real, discarding false positives, and exploiting the issues that matter to show genuine impact.
The combination exists because neither half is sufficient alone. An assessment on its own produces a long, noisy list that still needs human judgement and tends to miss anything requiring logic or chaining. A pentest on its own gives depth but, within a fixed budget, less breadth of coverage. Together they give you both: confidence that the whole scope was examined, and proof of which findings an attacker could actually use. This is why VAPT is the default request in so many contracts.
We deliver it as one engagement with one report. The assessment runs first to map the surface and surface candidate issues; our testers then verify and exploit by hand, so what reaches you is confirmed rather than raw. Findings are scored with CVSS v4.0, prioritised by real risk, and written for both executives and engineers. Critical issues are raised the moment we confirm them, and fixed findings are retested free of charge.
How we work with UK clients
- Testing windows set in UK time at scoping. India runs 4.5 hours ahead during British Summer Time and 5.5 hours ahead in winter, so our days overlap.
- Fixed proposals in GBP, excluding VAT; the reverse charge usually applies to UK business buyers.
- No traffic leaves our hands until written authorisation is signed by someone entitled to give it, as the Computer Misuse Act 1990 requires.
- Findings labelled for the evidence you file: ISO 27001 Annex A, UK GDPR Article 32, PCI DSS or a supplier questionnaire.
What's included
Our approach
- Scope & authorisationWe agree the full scope and obtain written authorisation to test it.
- AssessmentAutomated enumeration and scanning establish coverage and candidate issues.
- Manual testingTesters verify, exploit and chain the findings that carry real risk.
- Rating & triageConfirmed findings are scored and prioritised for remediation.
- Report & debriefOne risk-rated report is delivered and walked through with your team.
What you receive
- Single report covering assessment and penetration test
- Verified, risk-rated findings with CVSS v4.0 scores
- False positives removed before the report reaches you
- Remediation guidance for executives and engineers
- Free retest of fixed issues and an attestation letter
Standards & frameworks
- PTES
- NIST SP 800-115
- OWASP WSTG
- OWASP ASVS
- MITRE ATT&CK
- CVSS v4.0
- CWE
- UK GDPR Art. 32
- NHS DSPT
Frequently asked questions
Is VAPT different from a penetration test?
It is a penetration test with an explicit vulnerability-assessment stage bundled in, which is how most contracts phrase the requirement. In practice our pentests already include that breadth-first step, so asking for VAPT or a pentest usually gets you the same engagement.
What can VAPT cover?
Any scope we test: web and mobile applications, APIs, external and internal networks, cloud and more, singly or combined. We shape the assessment and testing effort to the surface involved, so a web VAPT and a network VAPT look quite different under the same name.
Why not just run a vulnerability scan?
A scan lists potential issues from signatures and leaves triage to you, including the false positives. VAPT adds the manual testing that confirms what is exploitable, finds the logic and chained flaws a scan cannot, and gives you findings you can act on with confidence.
Are your prices quoted with VAT?
Proposals are in GBP and exclude VAT. Because we supply from outside the UK, the reverse charge usually applies to UK business customers, so you account for VAT yourself. Your finance team or accountant can confirm the treatment for your organisation.
Can you deliver a CREST or CHECK report?
We don't claim CREST accreditation or CHECK membership. CHECK covers government, public-sector and CNI systems, and its testers need UK security clearance. If a contract names either, raise it at scoping and you'll get a plain answer on whether we can meet it.