VAPT Services: Vulnerability Assessment and Penetration Testing

VAPT (vulnerability assessment and penetration testing) is one engagement that does two jobs. The vulnerability assessment scans every system in scope for known weaknesses and validates the results, so nothing obvious is missed. The penetration test then attacks the systems that matter most by hand, to prove which weaknesses an attacker could exploit and how far they could get. You receive one report, one prioritised fix list and a retest once the fixes are in.

We scope VAPT across external and internal networks, web applications, APIs, cloud, mobile apps, wireless and connected devices, and price it as a fixed-price proposal. This page explains what a VAPT includes, what the report should contain and how often to repeat it.

What is VAPT?

VAPT stands for vulnerability assessment and penetration testing. It is not a separate testing standard. It is the name for buying both activities together, so that breadth and depth come from one provider working to one scope. You will also see it sold as VAPT testing or vulnerability and penetration testing services; the scope matters more than the label. VAPT in cyber security is therefore best read as a request for evidence of both breadth and depth, not as a single test.

• Vulnerability assessment gives breadth. Automated scanning, authenticated where possible, checks every host and application in scope for known vulnerabilities, missing patches and weak configuration. An analyst then removes false positives and rates what is left. Our guide to vulnerability assessment covers that process step by step.
• Penetration testing gives depth. An ethical hacker tries to exploit the findings, chains them together and looks for the flaws scanners cannot see, such as broken access control, business logic errors and privilege escalation. Our guide to what penetration testing is explains the method.

How the two compare on their own, in method, findings and cost, is covered in our guide to penetration testing vs vulnerability scanning.

Why do buyers ask for VAPT by name?

The term appears in tender documents, customer security questionnaires and contracts, particularly where an international partner or parent company sets the requirement. UK standards rarely use it. PCI DSS splits the work into vulnerability scanning (Requirement 11.3) and penetration testing (Requirement 11.4), and ISO 27001 deals with technical vulnerabilities under Annex A 8.8. When a contract asks for “a VAPT”, the useful first step is to confirm what evidence the requester actually needs, so the scope answers it.

What does a VAPT engagement include?

A VAPT runs in six stages. The hand-off between the two halves is what makes it worth buying as one engagement.

1. Scoping. We agree the systems, environments, user roles, testing windows and any standard the report must support, then fix the price.
2. Discovery. We confirm the live assets in scope, so testing covers what is really exposed rather than an out-of-date list.
3. Vulnerability assessment. Authenticated and unauthenticated scanning across the whole scope, followed by manual validation. False positives are removed and each finding is rated with CVSS and the context of your environment.
4. Penetration testing. Testers use the assessment results as a map, attempt exploitation by hand, chain weaknesses into attack paths and test what scanners miss. Each path stops at an agreed proof point.
5. Reporting. One report covers both halves, with a remediation plan ordered by risk.
6. Retest. Once you have fixed the findings, we retest them and reissue the report showing what is closed.

The penetration testing half follows the five stages of penetration testing: planning and reconnaissance, scanning, gaining access, maintaining access, and analysis and reporting.

Which systems can a VAPT cover?

Any system we penetration test can be scoped as a VAPT, and most engagements combine two or three of these:

The full range of test types, including social engineering, red team, source code review and AI and LLM testing, is on our penetration testing services page, and our guide to the types of penetration testing compares what each one finds.

How can you tell a real VAPT from a relabelled scan?

Ask how many days of the engagement are manual testing. Some offers labelled VAPT are an automated scan with a branded report, which meets neither PCI DSS Requirement 11.4 nor most customer contracts. Before you sign, check:

• that a named tester will attempt exploitation, not only run tools;
• whether internal and application scans are authenticated, so they see missing patches and settings that are invisible from outside;
• that every finding is validated and false positives are removed before the report;
• that a retest of fixed findings is included or priced up front;
• which methodology the testing follows, such as the OWASP Web Security Testing Guide for applications or NIST SP 800-115 for infrastructure.

What is included in a VAPT report?

A VAPT report should let a board member, an engineer and an auditor each find what they need quickly. Ours is structured like this:

After the retest we also provide an attestation letter, which you can share with customers and auditors instead of the full report. Our guide to reading a penetration test report explains how to turn findings into an action plan.

How often should you carry out VAPT?

Most organisations run the scanning half far more often than the testing half. A common pattern is vulnerability scanning every month or quarter, with a full VAPT at least once a year and after significant change, such as a new application, a migration or a network redesign. This is what the main standards ask for:

For PCI DSS, the quarterly external scans must come from an Approved Scanning Vendor. Sovereign Secure is a QSA company, not an ASV, so we deliver those scans through a PCI SSC Approved Scanning Vendor partner and carry out the rest of the VAPT ourselves. The testing requirements are explained on our PCI DSS penetration testing page, and the standard is in the PCI SSC document library.

If you only need the ongoing half, our vulnerability scanning services cover internal and external scans on a monthly or quarterly schedule, triaged before they reach you. The NCSC’s guidance on penetration testing makes the same distinction: a test checks that your vulnerability management works, it does not replace it.

How much do VAPT services cost?

VAPT is priced on the effort the scope needs, mostly tester-days for the manual half. The main drivers are the number of live IPs and hosts, the number of applications and user roles, whether scanning is authenticated, any compliance mapping such as PCI DSS segmentation testing, and the retest. As a sense check, published UK prices we reviewed in September 2026 put penetration testing day rates at about £1,000 to £1,500 per tester-day. Our penetration testing cost guide shows how each driver moves the price. We send a fixed price once the scope is agreed.

Why Sovereign Secure

• We are a PCI SSC Qualified Security Assessor (QSA) company, so VAPT reports intended for PCI DSS are written to the standard an assessor expects.
• We are ISO 27001 certified ourselves, and our reports support Annex A 8.8 evidence.
• One team covers web, API, network, cloud, mobile, hardware and IoT, wireless, social engineering, red team, source code and AI and LLM testing, plus vulnerability scanning, so a VAPT scope does not need splitting between providers.
• Proposals are fixed-price, with a retest of remediated findings agreed up front.
• Sovereign Secure Ltd was founded in 2012 and is headquartered in Accrington, Lancashire.

Get a VAPT quote

Tell us which systems you want covered, roughly how many IPs, applications and user roles are involved, and whether PCI DSS, ISO 27001 or a customer contract is driving the work. Our penetration testing quote form takes about two minutes, and we will come back with a fixed-price proposal. You can also call us on +44 161 523 5276.