The short answer
VAPT means Vulnerability Assessment and Penetration Testing — two activities. A penetration test is one of them. So VAPT is the broader term, and a pentest is a component of it.
There is also a vocabulary difference that confuses buyers comparing providers across markets: "VAPT" is the standard term in India and South Asia, while the US and UK markets almost always say "penetration testing" or "pentest". Search either phrase and you get an almost entirely different set of companies.
The two halves of VAPT
| Vulnerability assessment | Penetration test | |
|---|---|---|
| Approach | Broad, largely automated | Narrow, largely manual |
| Question | What weaknesses exist? | What can actually be exploited? |
| Output | A ranked list of findings | Proven attack paths with evidence |
| Duration | Hours to days | One to three weeks |
| Finds business logic flaws | No | Yes |
| Finds broken access control between roles | Rarely | Yes |
| Cost | Low | Substantially higher |
Buying only the assessment gives you a list. The penetration test tells you which items on that list actually matter. That is the whole distinction, and it is why price quotes labelled "VAPT" can differ by a factor of twenty.
Why the terminology splits by market
Nothing technical — it is convention. Indian security firms, and the compliance ecosystem around CERT-In and Indian enterprise procurement, standardised on "VAPT". US and UK firms standardised on "penetration testing", with "vulnerability scanning" as a separate product sold separately.
The practical consequences when you are comparing providers:
A US "penetration test" quote usually means manual testing only, with scanning either bundled invisibly or sold separately.
An Indian "VAPT" quote might mean either half, or both. The wide price range in the Indian market is largely this ambiguity — the same three letters covering both a one-day scan and a three-week manual engagement.
So the question to ask is identical in both markets: what proportion of this engagement is manual, and who performs it?
Which do you need?
| Situation | What you need |
|---|---|
| An enterprise customer asked for a pentest report | Manual penetration test — a scan will be rejected |
| ISO 27001 or SOC 2 audit evidence | Manual test plus a retest letter |
| PCI DSS | Penetration testing is explicitly required |
| Ongoing hygiene between annual tests | Vulnerability scanning, run regularly |
| Pre-launch check on a new feature | Targeted manual test of the changed surface |
| Board asked "are we secure?" | Manual test — a scan cannot answer that question |
For most compliance-driven buying the answer is the manual test, because that is what the reviewer will accept. See VAPT for ISO 27001 and SOC 2.
Cost, in both markets
Because the terminology differs, so does the pricing literature. Comparing an Indian VAPT quote against a US pentest quote without adjusting for both currency and scope definition produces misleading conclusions.
See what VAPT costs in India for rupee ranges by test type, and penetration testing cost for the US market. The underlying work is the same; what differs is the label, the currency and the day rate.
FAQs
Is VAPT the same as penetration testing?
Not exactly. VAPT stands for Vulnerability Assessment and Penetration Testing — two activities, of which a penetration test is one. VAPT is the broader term. In practice the words are also market conventions: India and South Asia say VAPT, while the US and UK say penetration testing.
What is the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment is broad and largely automated, producing a ranked list of known weaknesses in hours or days. A penetration test is narrow and largely manual, with a tester attempting to exploit findings and chain them into real attack paths over one to three weeks. Only the penetration test finds business logic flaws and broken access control between user roles.
Why does India say VAPT and the US say penetration testing?
Convention rather than anything technical. Indian security firms and the surrounding compliance ecosystem standardised on VAPT, while US and UK firms standardised on penetration testing with vulnerability scanning sold as a separate product. Searching each term returns almost entirely different companies.
Which do I need for SOC 2 or ISO 27001?
A manual penetration test, plus a retest letter confirming findings were closed. Neither standard names VAPT specifically, but both expect technical vulnerability management and auditors routinely accept a current manual test report as evidence. An automated scan report is frequently rejected.
Why do VAPT quotes vary so much more than pentest quotes?
Because VAPT covers both halves under one acronym, so a quote might be for a one-day automated scan or a three-week manual engagement. US pentest quotes vary less because scanning is usually sold separately. In both markets the question that resolves it is what proportion of the work is manual.
Where to go next
See rupee pricing by test type, penetration testing cost in the US, or the types of testing available.