VAPT Cost in India (2026): Price Ranges, What Drives Them and How to Compare Quotes
VAPT cost in India explained step by step: 2026 price ranges, how asset type and black or grey box testing change the quote, and how to compare vendors fairly.
VAPT Cost in India (2026): Price Ranges, What Drives Them and How to Compare Quotes
VAPT cost in India explained step by step: 2026 price ranges, how asset type and black or grey box testing change the quote, and how to compare vendors fairly.
Most Indian companies pay somewhere between ₹25,000 and ₹1.5 lakh to test a single web application in 2026, based on price guides published by Indian security firms this year. Testing a web app, an API, and a cloud account together usually lands between ₹1.5 lakh and ₹4 lakh. Mobile apps, internal networks, and large cloud setups sit higher.
The range is wide for a reason. A VAPT quote is the price of expert hours, not a tool. This guide breaks an engagement into the stages you pay for, so you can see what is inside any quote.
2026 VAPT price benchmarks across web, API, and cloud assets in India
What is VAPT, in one line?
VAPT (Vulnerability Assessment and Penetration Testing) is a security check where experts first find weaknesses in your systems and then safely try to exploit them, to prove which ones an attacker could really use.
The first half is broad and partly automated. The second is deep and mostly manual, and that is where most of the cost sits.
2026 market price ranges in India
These are indicative ranges published by Indian security firms in 2026. They are not fixed rates, and they are not SecurityLit's prices.
| What is tested | Typical published range (INR) |
|---|---|
| Small web application | ₹25,000 to ₹60,000 |
| Typical SaaS web app | ₹40,000 to ₹1.5 lakh |
| Large or banking web app | ₹1.5 lakh to ₹4 lakh and above |
| API | ₹40,000 to ₹1.2 lakh |
| Mobile app (per platform) | ₹50,000 to ₹2 lakh |
| External network | ₹30,000 to ₹1.2 lakh |
| Internal network | ₹60,000 to ₹2 lakh |
| Cloud environment | ₹50,000 to ₹5 lakh and above |
Use it to spot quotes that look far too low or high, not as a rate card.
Where your money goes: the six stages of a standard VAPT engagement
Where your money goes: the six stages of a VAPT
Every serious VAPT follows a set path. SecurityLit's own process runs in six stages, and each one uses tester time in a different way.
Stage 1: Scope definition and planning
The team lists and ranks every asset and agrees on method and timeline. It is short, but it decides the whole price.
Stage 2: Reconnaissance and discovery
Testers map domains, subdomains, open services and software versions. Forgotten test servers often show up here, and more exposure means more to test.
Stage 3: Vulnerability assessment
Automated scanning runs alongside manual checks and configuration review. It is the cheapest part per finding, and where low-cost vendors stop.
Stage 4: Exploitation and verification
Testers break in for real, in a controlled way, and prove the impact. This is where business logic flaws surface, such as one user reading another user's invoices by changing a number in a request. No scanner finds that, and this stage is usually the biggest share of your bill.
Stage 5: Compliance mapping
SecurityLit maps findings to ISO 27001 Annex A controls and SOC 2 Trust Services Criteria. It adds effort but saves your compliance team hours later. If you are preparing for an audit, a compliance pre-assessment can show gaps before testing starts.
Stage 6: Reporting and retest
You get a risk-ranked report with fix guidance, then a retest to prove the fixes work.
When you compare quotes, ask each vendor which of these six stages are included and how many days go into stage 4. That one question explains most price gaps.
The two choices that move the price most
1. What you are testing
SecurityLit's pricing calculator asks you to pick one of five targets: web application, API, mobile application, network or cloud. Each takes different work.
- Web apps: priced on screens, workflows and user roles.
- APIs: priced on endpoints and how login works.
- Mobile apps: tested per platform, so Android and iOS are two jobs.
- Networks: priced on IP addresses, inside, outside or both.
- Cloud gets priced on accounts and services. For AWS and Azure, configuration review is its own job.
2. How much the testers know before they start
SecurityLit's calculator offers two approaches, grey box and black box. White box testing is a third option, used when source code is shared.
- Black box: testers start with zero knowledge, like an outside attacker. It is realistic, but testers spend paid hours just finding their way in.
- Grey box: testers get limited information, such as a login. It focuses on what someone could do after getting some access, including privilege escalation. For most companies this gives the most findings per rupee.
- White box: testers see documentation and source code. It goes deepest, and it overlaps with a source code review.
Does a regulator change your cost?
Sometimes. Rules can limit who may test you, and fewer eligible firms can mean higher prices.
SEBI CSCRF
SEBI-regulated entities under the Cybersecurity and Cyber Resilience Framework (CSCRF) need audits and VAPT done by a CERT-In empanelled organisation.
RBI Cybersecurity Directions
NBFCs covered by RBI's July 2026 Cybersecurity Directions need vulnerability assessments every six months and penetration tests every twelve months for critical systems. The Directions ask for "appropriately trained and independent" testers and do not name CERT-In empanelment.
PCI DSS
Businesses handling card data under PCI DSS need a qualified, independent tester. A QSA is not required for the pentest itself.
Customer & Auditor Clauses
For everyone else, the requirement usually comes from a customer contract or an auditor. Read the exact clause before you pay for more than you need.
You can check any vendor's empanelment yourself on CERT-In's official list. This is general information, not legal advice.
Compare scope, not price: Check what is inside every VAPT proposal
How to compare two VAPT quotes fairly
Put both quotes side by side and check these points.
- Scope: Are the same apps, roles, endpoints, and IPs listed in both?
- Approach: Black box, grey box, or white box?
- Manual effort: How many tester days go into exploitation?
- Report: Does it have an executive summary for leaders and technical detail for engineers?
- Retest: Is at least one retest round included?
- Support after the report: Who answers your developers' questions? SecurityLit includes 30 days of post-assessment support for remediation guidance.
SecurityLit's calculator also has an "Other Vendor Quote" field, so you can compare a quote you already hold with an instant estimate.
When a yearly test is not enough
A yearly VAPT checks one moment in time. If you ship every week, new bugs arrive between tests, so some companies move to continuous pentesting, where experts test each release and findings go straight into tools like Jira and Slack. The cost is spread across the year instead of one large invoice.
If you need to test how your team detects and responds to a real attack, not just find bugs, that is red teaming. It is priced differently. This comparison explains the difference.
Frequently Asked Questions
Q1. What is the average VAPT cost in India in 2026?
For one web application, published 2026 guides from Indian firms put most engagements between ₹25,000 and ₹1.5 lakh. A combined web, API and cloud programme usually costs ₹1.5 lakh to ₹4 lakh. Your scope decides the final figure.
Q2. Why is grey box testing often better value than black box?
In black box testing, testers spend paid hours finding a way in. In grey box testing they get limited access up front and spend that time looking for deeper problems, such as privilege escalation. Most SaaS and fintech teams get more findings per rupee that way.
Q3. Is a ₹15,000 VAPT worth it?
For a full web application, a very low quote usually means automated scanning with little manual exploitation. It may work as a quick health check but rarely finds business logic flaws.
Q4. Does VAPT pricing include a retest?
Not always. Ask before you sign. A retest confirms your fixes work, and without it you only have a list of problems, not proof they are solved.
Want a number for your own scope?
Get an instant estimate with SecurityLit's pricing calculator, or book a free scoping consultation for a detailed quote tailored to your architecture.
Most Indian companies pay somewhere between ₹25,000 and ₹1.5 lakh to test a single web application in 2026, based on price guides published by Indian security firms this year. Testing a web app, an API, and a cloud account together usually lands between ₹1.5 lakh and ₹4 lakh. Mobile apps, internal networks, and large cloud setups sit higher.
The range is wide for a reason. A VAPT quote is the price of expert hours, not a tool. This guide breaks an engagement into the stages you pay for, so you can see what is inside any quote.
2026 VAPT price benchmarks across web, API, and cloud assets in India
What is VAPT, in one line?
VAPT (Vulnerability Assessment and Penetration Testing) is a security check where experts first find weaknesses in your systems and then safely try to exploit them, to prove which ones an attacker could really use.
The first half is broad and partly automated. The second is deep and mostly manual, and that is where most of the cost sits.
2026 market price ranges in India
These are indicative ranges published by Indian security firms in 2026. They are not fixed rates, and they are not SecurityLit's prices.
| What is tested | Typical published range (INR) |
|---|---|
| Small web application | ₹25,000 to ₹60,000 |
| Typical SaaS web app | ₹40,000 to ₹1.5 lakh |
| Large or banking web app | ₹1.5 lakh to ₹4 lakh and above |
| API | ₹40,000 to ₹1.2 lakh |
| Mobile app (per platform) | ₹50,000 to ₹2 lakh |
| External network | ₹30,000 to ₹1.2 lakh |
| Internal network | ₹60,000 to ₹2 lakh |
| Cloud environment | ₹50,000 to ₹5 lakh and above |
Use it to spot quotes that look far too low or high, not as a rate card.
Where your money goes: the six stages of a standard VAPT engagement
Where your money goes: the six stages of a VAPT
Every serious VAPT follows a set path. SecurityLit's own process runs in six stages, and each one uses tester time in a different way.
Stage 1: Scope definition and planning
The team lists and ranks every asset and agrees on method and timeline. It is short, but it decides the whole price.
Stage 2: Reconnaissance and discovery
Testers map domains, subdomains, open services and software versions. Forgotten test servers often show up here, and more exposure means more to test.
Stage 3: Vulnerability assessment
Automated scanning runs alongside manual checks and configuration review. It is the cheapest part per finding, and where low-cost vendors stop.
Stage 4: Exploitation and verification
Testers break in for real, in a controlled way, and prove the impact. This is where business logic flaws surface, such as one user reading another user's invoices by changing a number in a request. No scanner finds that, and this stage is usually the biggest share of your bill.
Stage 5: Compliance mapping
SecurityLit maps findings to ISO 27001 Annex A controls and SOC 2 Trust Services Criteria. It adds effort but saves your compliance team hours later. If you are preparing for an audit, a compliance pre-assessment can show gaps before testing starts.
Stage 6: Reporting and retest
You get a risk-ranked report with fix guidance, then a retest to prove the fixes work.
When you compare quotes, ask each vendor which of these six stages are included and how many days go into stage 4. That one question explains most price gaps.
The two choices that move the price most
1. What you are testing
SecurityLit's pricing calculator asks you to pick one of five targets: web application, API, mobile application, network or cloud. Each takes different work.
- Web apps: priced on screens, workflows and user roles.
- APIs: priced on endpoints and how login works.
- Mobile apps: tested per platform, so Android and iOS are two jobs.
- Networks: priced on IP addresses, inside, outside or both.
- Cloud gets priced on accounts and services. For AWS and Azure, configuration review is its own job.
2. How much the testers know before they start
SecurityLit's calculator offers two approaches, grey box and black box. White box testing is a third option, used when source code is shared.
- Black box: testers start with zero knowledge, like an outside attacker. It is realistic, but testers spend paid hours just finding their way in.
- Grey box: testers get limited information, such as a login. It focuses on what someone could do after getting some access, including privilege escalation. For most companies this gives the most findings per rupee.
- White box: testers see documentation and source code. It goes deepest, and it overlaps with a source code review.
Does a regulator change your cost?
Sometimes. Rules can limit who may test you, and fewer eligible firms can mean higher prices.
SEBI CSCRF
SEBI-regulated entities under the Cybersecurity and Cyber Resilience Framework (CSCRF) need audits and VAPT done by a CERT-In empanelled organisation.
RBI Cybersecurity Directions
NBFCs covered by RBI's July 2026 Cybersecurity Directions need vulnerability assessments every six months and penetration tests every twelve months for critical systems. The Directions ask for "appropriately trained and independent" testers and do not name CERT-In empanelment.
PCI DSS
Businesses handling card data under PCI DSS need a qualified, independent tester. A QSA is not required for the pentest itself.
Customer & Auditor Clauses
For everyone else, the requirement usually comes from a customer contract or an auditor. Read the exact clause before you pay for more than you need.
You can check any vendor's empanelment yourself on CERT-In's official list. This is general information, not legal advice.
Compare scope, not price: Check what is inside every VAPT proposal
How to compare two VAPT quotes fairly
Put both quotes side by side and check these points.
- Scope: Are the same apps, roles, endpoints, and IPs listed in both?
- Approach: Black box, grey box, or white box?
- Manual effort: How many tester days go into exploitation?
- Report: Does it have an executive summary for leaders and technical detail for engineers?
- Retest: Is at least one retest round included?
- Support after the report: Who answers your developers' questions? SecurityLit includes 30 days of post-assessment support for remediation guidance.
SecurityLit's calculator also has an "Other Vendor Quote" field, so you can compare a quote you already hold with an instant estimate.
When a yearly test is not enough
A yearly VAPT checks one moment in time. If you ship every week, new bugs arrive between tests, so some companies move to continuous pentesting, where experts test each release and findings go straight into tools like Jira and Slack. The cost is spread across the year instead of one large invoice.
If you need to test how your team detects and responds to a real attack, not just find bugs, that is red teaming. It is priced differently. This comparison explains the difference.
Frequently Asked Questions
Q1. What is the average VAPT cost in India in 2026?
For one web application, published 2026 guides from Indian firms put most engagements between ₹25,000 and ₹1.5 lakh. A combined web, API and cloud programme usually costs ₹1.5 lakh to ₹4 lakh. Your scope decides the final figure.
Q2. Why is grey box testing often better value than black box?
In black box testing, testers spend paid hours finding a way in. In grey box testing they get limited access up front and spend that time looking for deeper problems, such as privilege escalation. Most SaaS and fintech teams get more findings per rupee that way.
Q3. Is a ₹15,000 VAPT worth it?
For a full web application, a very low quote usually means automated scanning with little manual exploitation. It may work as a quick health check but rarely finds business logic flaws.
Q4. Does VAPT pricing include a retest?
Not always. Ask before you sign. A retest confirms your fixes work, and without it you only have a list of problems, not proof they are solved.
Want a number for your own scope?
Get an instant estimate with SecurityLit's pricing calculator, or book a free scoping consultation for a detailed quote tailored to your architecture.