The honest answer is ₹1.5 lakh to ₹25 lakh, depending on what you are testing and how deep you need the engagement to go. The dishonest answer is the ₹50,000 quote that covers a scanner report with a cover page. This guide explains what drives real VAPT pricing in India so you can compare quotes on substance rather than sticker price.
What is included in a VAPT engagement
A proper VAPT engagement is not a tool scan. It includes scoping (defining which assets, environments and user roles are in play), automated vulnerability scanning, manual penetration testing (where an operator actually tries to exploit findings), evidence collection, risk-rated reporting, and a free retest window after remediation. Vendors who skip the manual testing phase will always quote lower — and their report will always miss the findings that matter.
For a primer on the methodology behind these engagements, see our penetration testing and VAPT guide for India. For the compliance layer, see the CERT-In empanelled audit guide.
VAPT pricing ranges by scope in 2026
| Scope | Typical Range (₹) | What Drives Cost Up |
|---|---|---|
| Single web application (unauthenticated) | ₹1.5 L – ₹3 L | Number of roles, API endpoints, file upload, payment flows |
| Web app + authenticated (multi-role) | ₹3 L – ₹6 L | Role count, workflow complexity, business logic depth |
| API-only (REST / GraphQL) | ₹2 L – ₹5 L | Endpoint count, auth model (OAuth/JWT/mTLS), rate limiting |
| Mobile app (Android + iOS) | ₹3 L – ₹7 L | Native vs hybrid, cert pinning bypass, backend API scope |
| Internal network (up to 500 IPs) | ₹4 L – ₹8 L | Active Directory complexity, VLAN segmentation, OT/IoT |
| Cloud posture (AWS / Azure / GCP) | ₹3 L – ₹8 L | Account count, IAM complexity, container/K8s presence |
| Full-scope enterprise (web + network + cloud + mobile) | ₹10 L – ₹25 L | Asset count, compliance format (RBI SAR / SEBI / CERT-In) |
What drives VAPT cost higher
- **Scope breadth** — more applications, more IPs, more environments (staging + production) means more days of testing.
- **Depth of manual testing** — a grey-box engagement with multiple authenticated roles costs 2-3x more than an unauthenticated scan because each role requires separate test passes.
- **Compliance reporting format** — a CERT-In format report, an RBI System Audit Report, or a SEBI cybersecurity attestation carries specific structure requirements. Vendors who hold CERT-In empanelment charge more because the report is legally acceptable without rework.
- **Retest window** — a 30-day free retest is standard. Extended retest windows (60–90 days) or multiple retest cycles add cost.
- **Operator certification level** — engagements staffed by OSCP/OSWE/OSEP-certified operators cost more than those staffed by CEH-only teams. The finding quality is materially different.
- **Timeline compression** — a 2-week turnaround on a scope that normally takes 4 weeks requires parallel operators and carries a premium.
How to compare VAPT quotes
When you have 3-4 quotes on the table, normalize them on these dimensions before comparing price:
- **Scope definition** — are all vendors quoting against the same asset list and environment? A quote that excludes the API or the mobile app is not cheaper, it is narrower.
- **Manual vs automated** — ask each vendor what percentage of the engagement is manual exploitation vs automated scanning. Below 60% manual is a scan report.
- **Operator credentials** — ask for the certifications of the people who will actually do the testing, not the company's collective credentials.
- **Report format** — will the report satisfy your regulator (CERT-In, RBI, SEBI, IRDAI) without rework? Ask for an anonymised sample.
- **Retest included** — is remediation verification included? How many cycles? What is the window?
- **CERT-In empanelment** — for regulated entities, only a CERT-In empanelled auditor produces a report that regulators accept at face value. Non-empanelled vendors produce reports that may trigger follow-up queries. See our top CERT-In empanelled audit providers for a ranked comparison.
Annual programme vs one-off engagement
A single VAPT engagement is a snapshot. An annual programme — quarterly or continuous testing — costs 2-3x the one-off price but catches the vulnerabilities introduced by every release cycle. For organisations shipping code weekly, a one-off VAPT is outdated before the report is read. Most of our BFSI and SaaS clients run quarterly cycles mapped to their release cadence.
For a comparison of engagement models beyond VAPT — including red team assessments and managed security programmes — see VAPT vs red team and the top VAPT companies in India buyer guide.
City-specific pricing notes
VAPT pricing in India does not vary significantly by city — most engagements are delivered remotely with an on-site kickoff and exit briefing. Whether you are in Mumbai, Bengaluru, Delhi NCR, Hyderabad or Pune, the pricing ranges above apply. On-site testing (for network VAPT or air-gapped environments) may carry travel costs for engagements outside Mumbai.
Tell us what you are testing, your compliance requirement, and your timeline. We will give you a fixed-price quote — no hourly billing, no scope creep.