VAPT explained: what it tests and how often to do it

"VAPT" gets used as one word, but it stands for two different activities that work best together.

Vulnerability assessment vs penetration testing

A vulnerability assessment finds weaknesses. It combines automated scanning with manual checks across every asset in scope and produces a list of what is exposed.

A penetration test goes further. Testers try to exploit those weaknesses the way a real attacker would, chaining findings together to see what data or systems they can actually reach. The value is proof: you learn which issues matter, not just which exist.

Black, grey and white box

• Black box: the tester starts with zero knowledge, like an outside attacker.
• Grey box: the tester has partial access, such as a normal user account.
• White box: the tester has full internal view, including architecture and code.

Black box shows what a stranger can do. White box is the most thorough. Grey box is a common middle ground for web and mobile applications.

What a good test covers

For applications, expect checks for broken access control, injection, weak authentication, insecure design, session handling flaws and business-logic abuse, such as changing a price before payment or taking over an account through weak password recovery.

How often should you test?

A practical rule: test before launch, after any major change to the application or infrastructure, and at least once a year. Some standards, such as PCI DSS, expect penetration testing at least annually and after significant changes, so check what applies to you.

What to ask for in the report

Ask for findings ranked by risk, each with proof, business impact and a clear fix an engineer can follow, plus a re-test once fixes are done. A 200-page scanner export is not a report.

If you would like to scope a test for your own applications, get in touch.