A bank, a payment aggregator or a large client has asked for a VAPT report, and you now have three quotes that look nothing alike. One vendor offers a "full VAPT" at a price that seems too low, delivered in two days. Another wants a scoping call before it gives any price. A third says it is CERT-In empanelled but cannot show you where.
This guide is for founders, CTOs and finance heads who have to pick one. It explains how to tell a real penetration test from an automated scan sold under the same name, which questions to ask before you sign, the red flags that should end the conversation, and how to put quotes side by side so you compare like with like.
Quick answer: Choose a VAPT company by fixing your scope first, then checking four things: the testing is mostly manual with proof for each finding, the vendor shows you a redacted sample report, a re-test after fixes is written into the quote, and any CERT-In empanelment claim matches the official list. Compare quotes on scope, tester effort and deliverables, not on the headline price.
Start with who will read the report
Before you contact any vendor, find out who asked for the test and what they will accept. The answer decides your shortlist, so settle it before anything else.
- Bank or payment aggregator onboarding: ask whether they need a report from a CERT-In empanelled auditor or from any qualified independent tester. Requirements differ between institutions, so get the answer by email.
- Enterprise client security review: expect to be asked for a recent report with scope, method, severity ratings and evidence that high-risk issues were fixed. Some reviewers also want a closure letter after the re-test.
- ISO 27001 or SOC 2 evidence: the auditor wants to see that you test regularly and fix what you find. ISO 27001 does not require a CERT-In empanelled tester.
- Government or regulated work: if a tender, department or regulator specifies a CERT-In empanelled auditor, only an empanelled organisation can sign that report.
If empanelment is required, check the vendor's exact legal name on the list published on the CERT-In website, and confirm the empanelment will still be valid on the date the report is signed. EthicsComputer is not a CERT-In empanelled auditor. Our VAPT follows CERT-In guidelines, and we tell you before you book if your reviewer needs an empanelled firm.
Penetration test or automated scan: how to tell
Both get sold as VAPT. A vulnerability scan runs a tool against your site and lists known weaknesses, such as outdated software, weak TLS settings or missing security headers. A penetration test uses a person who logs in as different users, tries to break access rules and business logic, and proves what an attacker could actually do. A scan has its place, but it cannot tell you that one customer can open another customer's invoice by changing a number in the URL.
| What to look at | Automated scan sold as VAPT | Manual penetration test |
|---|---|---|
| How findings are produced | Tool output, often exported as it is | Tools for coverage, then hands-on testing of each feature |
| Logged-in testing | Often none, or a single user | Every user role named in the scope |
| Access control and business logic | Usually not covered | Tested by hand, for example one user reaching another user's data (IDOR) |
| False positives | Passed straight to you | Checked and removed before the report |
| Evidence | Generic description and a reference number | Proof of concept, affected URL or endpoint, steps to reproduce |
| Severity | The tool's default rating | CVSS score adjusted to your context |
| Fix guidance | Generic advice | Specific steps for your developers, then a re-test |
Ask every vendor which method they follow. The OWASP Web Security Testing Guide is the common reference for web applications, and NIST SP 800-115 and PTES are used for wider engagements. A vendor who cannot name a method is unlikely to be following one.
Questions to ask before you sign
- Who will do the testing? Ask for the tester's role and experience, and whether the same person joins the scoping call. Check that the work is not passed to an unnamed subcontractor.
- How much of it is manual? Ask which areas they test by hand: login and session handling, user roles, payment or approval workflows, file uploads and APIs.
- Can I see a redacted sample report? A real provider has one. Look for proof of concept, CVSS scores, business impact and fix steps for each finding.
- Is a re-test included? Ask how many rounds, within what window, and whether you receive a closure report once fixes are verified.
- What are the rules of engagement? Testing windows, production or staging, what is off limits, how test data is cleaned up, and who to call if something breaks.
- How will you handle our data? Ask for a mutual NDA before you share credentials, and how long they keep reports, screenshots and test accounts.
- If you claim CERT-In empanelment, what is the registered name? Match it with the official list and check the period of validity.
- What exactly is in the price? The number of applications, APIs, user roles and IP addresses, whether GST is extra, and what would change the price.
Red flags that should end the conversation
- "CERT-In certified" wording: CERT-In empanels auditing organisations for a fixed period. It does not certify companies or their websites, so this phrase on a vendor's site or in a report is a warning sign.
- Empanelment you cannot verify: the name is missing from the official list, the empanelment has lapsed, or the report would be signed by a different company.
- A price before any scoping: a vendor who quotes without asking about user roles, APIs or integrations is pricing a scan, not a test.
- No sample report: confidentiality is a fair reason to redact, not a reason to show nothing.
- No re-test, or a re-test billed per finding: you are left without independent proof that the fixes work.
- Promises about outcomes: anyone who promises your application will be fully secure after the test is selling comfort. A test reports what was found within the agreed scope and time.
- Testing without written authorisation: a legitimate tester insists on a signed scope and rules of engagement before touching your systems.
- Hundreds of findings with no priorities: a raw scanner export leaves your developers to do the tester's job.
How to compare VAPT quotes line by line
Quotes only become comparable when every vendor prices the same scope. Write a one-page scope listing applications, URLs, APIs, mobile builds, user roles, IP ranges, and whether testing happens on staging or production. Send the same document to each vendor, then compare the replies on these lines:
| Line item | What to check |
|---|---|
| Scope | Every application, API, mobile build and IP range named, with the user roles to be tested |
| Approach | Authenticated or not, black-box or grey-box, and the share of manual effort |
| Effort | Tester-days, or at least the length of active testing |
| Method | OWASP WSTG, NIST SP 800-115 or PTES, with CVSS for severity |
| Report | Executive summary, proof of concept per finding, business impact and fix steps |
| Re-test | Included or extra, number of rounds, and the window after the first report |
| Closure | A closure report or letter once fixes are verified |
| Commercials | GST invoice, payment milestones and what would change the price |
A low quote with no named tester, no effort estimate and no re-test is not a cheaper version of the same work. It is usually different work. For reference, EthicsComputer publishes its packages: Starter at ₹25,000 for one website or web app and its core server, Professional Growth at ₹60,000 for a web app, APIs, a mobile app, a cloud review and a compliance gap assessment, and Enterprise Full-Spectrum from ₹1.2 lakh for external and internal networks and social engineering. A single mobile or network test starts at ₹25,000, and the re-test after fixes is free. The VAPT cost guide explains what each package includes.
How EthicsComputer can help
EthicsComputer runs manual-first VAPT for web apps, APIs, mobile apps, networks and cloud, with a proof of concept, a CVSS v3.1 score and fix guidance for every finding. Each engagement starts with a mutual NDA and a written scope, and a re-test is included once you have fixed the findings. If you are still deciding what kind of test you need, read VA vs VAPT or the checklist on preparing for a web application penetration test.
Comparing VAPT quotes right now?
Send us your scope or the quotes you have received, and we will explain what a manual test of that scope should cover.
About the author
Vinay Grover founded EthicsComputer in Rohtak, Haryana in 2018 and leads its cybersecurity, software and AI work for clients across India and abroad. EthicsComputer is ISO 9001, ISO/IEC 27001 and ISO 20000-1 certified.
