Managed Security Costs, Price Drivers and 2026 Rules
VAPT cost in India: scope, test days and CERT-In empanelled auditors
How vulnerability assessment and penetration testing is priced in India — IPs, apps, test days, retests — when a CERT-In empanelled auditor is needed, and the 2025 audit policy guidelines.
A VAPT (vulnerability assessment and penetration testing) engagement is priced mainly by scope and effort: how many IP addresses, web applications, APIs and mobile apps are tested, whether the test is black-box or with credentials, and how many tester-days that takes, plus the retest after you fix the findings. For an Indian MSME, illustrative prices run from well under ₹1 lakh for an external network scan with light manual testing to several lakh for a full application and network test. If a regulator, government department or customer requires it, the work must be done by a CERT-In empanelled auditor; CERT-In publishes the list and in July 2025 issued its Comprehensive Cyber Security Audit Policy Guidelines (Version 1.0) that empanelled auditors and auditees must follow. This guide explains both, and is part of the managed security pricing overview.
VA, PT and VAPT: what you are buying
| Element | What happens | Output |
|---|---|---|
| Vulnerability assessment (VA) | Automated and semi-automated scanning for known weaknesses and misconfigurations | List of vulnerabilities with severity |
| Penetration testing (PT) | Testers try to exploit weaknesses, chain them and reach data, as an attacker would | Proof of exploitation, attack paths, business impact |
| Retest | Testers check that fixed findings are really closed | Closure report or updated certificate |
A scan-only "VAPT" at a very low price is usually a VA with a report template. Ask how many manual tester-days are included.
What drives the price
- Number of targets: public IPs, internal subnets, web apps, APIs, mobile apps (Android and iOS count separately), cloud accounts.
- Size of each app: number of roles, pages, API endpoints and business flows.
- Approach: black-box (no credentials), grey-box (user credentials), white-box (code and architecture access).
- Environment: production testing needs more care and off-hours windows; a staging copy is cheaper and safer.
- Report requirements: a regulator-format report, a certificate or "safe-to-host" letter, or metadata submission adds work.
- Retests: one retest included is common; more are extra.
Illustrative price bands
| Scope | Typical effort | Illustrative price (before GST) |
|---|---|---|
| External network, up to 10 public IPs | 2–4 tester-days | ₹60,000–₹1,50,000 |
| One web application, medium size, grey-box | 5–8 tester-days | ₹1,00,000–₹2,50,000 |
| Web app + API + Android + iOS | 10–18 tester-days | ₹2,50,000–₹6,00,000 |
| Internal network, 1 office, up to 200 hosts | 4–8 tester-days | ₹1,00,000–₹3,00,000 |
| Cloud configuration review, one account | 3–6 tester-days | ₹75,000–₹2,00,000 |
A common way to sense-check a quote is tester-days × day rate. If an illustrative day rate is ₹18,000–₹30,000, a 6-day web app test should land around ₹1,08,000–₹1,80,000 before the report and retest.
Worked example (illustrative)
An e-commerce MSME needs its website, payment-related API and Android app tested by an empanelled auditor before a marketplace partnership.
- Web app, grey-box: 6 days
- API: 3 days
- Android app: 4 days
- Report and one retest: 2 days
15 days × ₹22,000 = ₹3,30,000. GST 18% = ₹59,400. Total ₹3,89,400. Check this with the GST-inclusive price calculator.
CERT-In empanelled auditors
CERT-In empanels information security auditing organisations after technical evaluation and publishes the current list on its website. An empanelled auditor is required where a rule or contract says so; common triggers include government and public-sector work, some sector regulators' requirements, and customers who write it into security schedules. For other businesses it is a sensible benchmark but not a legal requirement for every test.
The Comprehensive Cyber Security Audit Policy Guidelines (2025)
On 25 July 2025 CERT-In issued the Comprehensive Cyber Security Audit Policy Guidelines, Version 1.0, under section 70B of the IT Act. Published summaries describe them as binding on CERT-In empanelled auditor organisations and on auditee entities for audits carried out under them, and as covering the full audit lifecycle: scoping from an asset inventory, risk-based testing, evidence handling, reporting, remediation tracking and retesting, with rules on auditor independence and the handling and retention of audit data. Commentary also reports that audits are expected at least yearly, with periodicity set by the criticality of the assets and an extra audit after major changes, and that audit reports go to CERT-In within a few days of completion.
How to prepare and save money
- Write an asset list first. Testers bill time spent discovering what you should have told them.
- Fix the obvious before testing: default passwords, unpatched servers, exposed admin panels. You pay to find things you already know otherwise.
- Use a staging copy that mirrors production where possible.
- Ask for one retest window in the price and a date by which fixes must be ready.
- Agree the authorisation letter and test window in writing. See authorisation for pen tests under the IT Act.
- Keep the reports. Customers, insurers and auditors will ask for them.
How often to test
There is no single legal frequency for every MSME. Common practice is a yearly test and a test after major changes (new app release, new office network, cloud migration). Regulated entities and government suppliers should follow their own regulator or contract.
FAQ
Is an automated scan enough?
It finds known issues cheaply and is worth running monthly or quarterly. It does not find logic flaws or chained attacks, which is what penetration testing is for.
Can our managed security provider do the VAPT?
It can, but independence matters: the team that configured your firewall testing its own work is a conflict. Many firms use a separate auditor, at least for yearly tests.
What should the report contain?
Scope, method, dates, each finding with evidence and severity, business impact, fix advice and retest status. A one-page certificate alone is not enough for your IT team.
