A VAPT audit in India starts at about ₹25,000 for one website or web app and its server. At EthicsComputer that Starter Audit is ₹25,000, a web, API, mobile and cloud audit is ₹60,000, and an enterprise audit of networks, internal systems and staff starts at ₹1.2 lakh.
Those are starting prices for a defined scope, published on our company security audit page. This guide explains what each package tests, what moves a quote up, and how the prices compare with other Indian VAPT providers.
The three VAPT packages and what they test
| Package | What is tested | Starting price |
|---|---|---|
| Starter Audit | One website or web application, its core server, and a 20-point security configuration checklist | ₹25,000 |
| Professional Growth Audit | A web application with its REST or GraphQL APIs, an Android or iOS app, a cloud architecture review (AWS, Azure or GCP) and a compliance gap assessment | ₹60,000 |
| Enterprise Full-Spectrum | External and internal network penetration testing, social engineering and phishing simulation, Active Directory and endpoint review, and ISO 27001 / CERT-In alignment support | from ₹1.2 lakh |
Need only one thing tested? A single mobile app test, or a single network or cloud test, starts at ₹25,000 and is quoted on scope.
What decides your final quote
The price follows the amount of testing work, not the size of your company. A quote counts:
- Applications: each website, web app or mobile app in scope.
- APIs: how many endpoints there are and how they authenticate.
- User roles: an app with admin, staff and customer logins needs every role tested.
- IP addresses and cloud accounts: for network and cloud work.
- Compliance reporting: a compliance gap assessment is part of the Professional Growth Audit.
A bigger scope also takes longer. The VAPT cost estimator shows the matching package and a timeline for your scope.
What every package includes
- Manual testing to OWASP methodology (OWASP Top 10, the API Top 10 and MASVS for mobile), so false positives are removed before you see the report.
- Findings rated by CVSS severity, each with proof of concept and step-by-step fix guidance for your developers.
- High-severity issues flagged within 24 hours, not saved for the final report.
- A free re-test after you fix the findings, then an audit completion certificate.
- A mutual NDA and written rules of engagement before any testing starts.
How these prices compare with other Indian providers
Most VAPT companies in India publish ranges rather than fixed packages. Two recent examples:
- TCSA (published 10 June 2026) gives ₹40,000 to ₹1.5 lakh for a typical web application, ₹50,000 to ₹1.5 lakh per mobile platform, and ₹1.5 lakh to ₹4 lakh for a combined web, API and cloud test.
- Securium Solutions (published 2 June 2026) gives ₹25,000 to ₹60,000 for a small website or basic web app, ₹60,000 to ₹1.5 lakh for a medium web app, and ₹60,000 to ₹2 lakh or more for a mobile app.
Our packages sit at the lower end of those ranges because they are starting prices for a defined scope. A large application with many roles and APIs costs more, and the written quote after the scoping call states the exact price. Figures as of 29 October 2026.
When you need a CERT-In empanelled auditor instead
EthicsComputer is not a CERT-In empanelled auditor. Our reports follow CERT-In guidelines, which helps you find and fix issues before a formal audit. If a regulator, government tender or client contract asks for a report from a CERT-In empanelled auditor, you need an empanelled firm for that report. Ask for the requirement in writing before you buy any VAPT, so you pay for the report you actually need.
How to get an exact price
- Pick the closest package above, or run the estimator.
- Book a free scoping call. We sign a mutual NDA first.
- Get a written quote with a fixed price, the scope and the timeline.
Get a fixed VAPT quote
See which package fits your scope, or book the Starter Audit at ₹25,000.
