VAPT cost in India (2026): what you should pay, and what drives the price

You asked three firms for a VAPT quote and got back ₹35,000, ₹1.8 lakh and ₹6 lakh for what looks like the same job. Nobody explained the gap. The cheapest one promises a report in three days. The most expensive one wants a scoping call first. You need a number for the budget note, and you need to know which quote will stand up when the auditor, the regulator or an attacker looks at your systems.

Last reviewed on 28 September 2026 against published price guides from seven Indian providers, the RBI Cybersecurity Directions 2026, SEBI CSCRF and IBM's 2026 India breach report.

How much does VAPT cost in India in 2026?

VAPT cost in India in 2026 ranges from about ₹20,000 for an automated scan to ₹12 lakh or more for a large web platform, based on published guides from Indian providers. A single manual web application test typically costs ₹40,000 to ₹3.5 lakh. Prices are market ranges, not quotes, and depend on scope and depth.

We read the public pricing pages and price guides of seven Indian security firms, all published or updated in 2026. Every one of them says the same thing first: the price depends on scope. Every one of them then gives ranges anyway, because buyers need a starting point. The ranges overlap a lot, which is useful. It tells you where the market sits.

Here is the short version, before we break it down by asset type.

• Scan-only work (a tool runs, a report is exported) is quoted at about ₹20,000 to ₹50,000²⁴. RingSafe puts its "automated-scan tier" at ₹25,000 to ₹60,000⁸.
• A competent manual test of one scope (one web app, one API or one mobile app) is quoted at about ₹75,000 to ₹2.5 lakh, over 5 to 15 billable days⁸.
• Compliance-grade manual engagements run from about ₹3 lakh to ₹8.5 lakh, and complex multi-system work goes to ₹10 lakh and above².
• Multi-asset or deep-scope programmes are quoted at ₹3 lakh to ₹12 lakh, and large audit-brand firms start around ₹15 lakh⁸.

What drives the price of a penetration test?

Penetration test pricing is driven mostly by tester days. Anything that adds days adds cost: more pages, endpoints or IPs, more user roles, deeper manual work, retests, a CERT-In empanelled auditor, a regulator-ready report, onsite work and a rush deadline. Scope size and manual depth usually move the price the most.

A VAPT quote is mostly skilled time. Tools are cheap. People who can chain two medium findings into a real breach are not. SquareOps sums it up: automated scanning is cheap because it is machine time, and manual testing is expensive². Published timelines back this up. A single web app or API takes about 5 to 15 working days of testing, and cloud or IoT work can take 7 to 20³.

VAPT

Vulnerability Assessment and Penetration Testing. The VA part finds and lists known weaknesses, often with tools. The PT part tries to exploit them, the way an attacker would, to prove what is really at risk. Our guide to vulnerability assessment vs penetration testing explains the difference in detail.

The nine price drivers

1. Scope size. The number of apps, pages, API endpoints, IPs, cloud accounts and mobile builds. This is the first thing every guide asks for².
2. Authenticated roles. Each user role (customer, agent, admin, auditor) is a separate view of the app to test. CyberSigma prices a moderate web app with about 5 to 8 roles at ₹1.2 lakh to ₹3.5 lakh⁶. Testing without logins is cheaper and much less useful².
3. Box type. Black box means no inside knowledge. Grey box gives testers logins and some documents. White box adds source code or architecture access. More access usually means more days, and more real findings.
4. Manual depth. The ratio of human testing to tool output. Business logic flaws, broken access control and chained attacks need people.
5. Retest. A second pass to confirm your fixes worked. Some firms include one round. Others bill it later³⁶.
6. Empanelled auditor. If a regulator needs a CERT-In empanelled firm, your vendor pool shrinks and formal certification is added. CyberSigma lists this as a factor that pushes the price higher⁶.
7. Report format. A regulator or board-ready report, mapped to a framework and signed off, takes more time than a findings list. Compliance-driven testing costs more because of documentation, validation and reporting².
8. Onsite work. Internal network tests on isolated networks may need testers at your premises, which adds travel and fixed days.
9. Urgency. A report needed by Friday for an audit means pulling testers off other work. Expect to pay for that, or to get less depth.

A VAPT quote is a price for tester days. Ask how many days you are buying, and what a person does on each one.

VAPT cost by asset type

VAPT cost by asset type in India, per published 2026 guides: small web apps about ₹25,000 to ₹90,000, medium web apps ₹40,000 to ₹3.5 lakh, APIs ₹30,000 to ₹4 lakh, mobile apps ₹40,000 to ₹3 lakh per platform, and cloud configuration reviews ₹50,000 to ₹5 lakh per environment.

The table below pulls together the ranges each provider published. The "typical published range" runs from the lowest low to the highest high we found. The "median band" is the middle of the low ends and the middle of the high ends. That band is what our estimator uses, because it is less pulled by one very cheap or very expensive firm.

Web application VAPT cost

Web apps have the widest spread because "a web app" can mean a 15-page brochure site or a banking portal with a dozen roles. BM Infotrade sorts them into small (₹25,000 to ₹60,000), medium (₹60,000 to ₹1.5 lakh) and large (₹1.5 lakh to ₹4 lakh or more)⁴. Factosecure's bands are a little higher, topping out at ₹5 lakh⁵. CyberSigma puts large, multi-tenant SaaS platforms at ₹4 lakh to ₹12 lakh or more, over 3 to 6 weeks⁶.

API and mobile app penetration testing cost

API tests are priced on endpoints and auth flows. CyberSigma's API range of ₹1 lakh to ₹4 lakh assumes about 50 to 150 endpoints⁶, while smaller APIs are quoted from about ₹30,000 to ₹40,000¹⁵. Mobile app tests are usually priced per platform, so Android and iOS are two line items¹⁶. Cybersecify lists both at ₹60,000 to ₹2.5 lakh, over 7 to 12 days each³. A mobile app almost always talks to an API, so check whether the API is inside the mobile quote or a separate one.

Pentest cost per IP and network VAPT

For external networks, BM Infotrade publishes ₹1,000 to ₹5,000 per IP, and ₹40,000 to ₹1.2 lakh for up to 25 IPs⁴. Per-IP rates usually fall as the range grows. CyberSigma quotes a full /24 (about 256 addresses) at ₹60,000 to ₹2 lakh⁶. Internal networks cost more because testers look for lateral movement, not just open ports. CyberSigma's internal and Active Directory range reaches ₹6 lakh⁶. If AD is in scope, read our guide on Active Directory penetration testing before you sign.

Does a CERT-In empanelled audit cost more?

A CERT-In empanelled VAPT audit usually costs more than a non-empanelled test, according to Indian providers, because fewer firms qualify and the work carries formal reporting. None of the guides we reviewed publishes a fixed percentage. For SEBI regulated entities, empanelment is required, so the real choice is between empanelled firms.

CERT-In, India's national computer emergency response team, keeps a list of empanelled information security auditing organisations¹⁸. Being on that list means CERT-In has assessed the firm. It does not set prices.

Whether you need an empanelled auditor depends on who regulates you:

• SEBI regulated entities: the CSCRF says that, unless stated otherwise, all audits in the framework must be done by a CERT-In empanelled IS auditing organisation¹⁴. SEBI's FAQs repeat this for DAST and SAST on in-house and COTS software¹⁵. See our breakdown of SEBI CSCRF VAPT requirements.
• RBI regulated entities: the NBFC Directions ask for "appropriately trained and independent information security experts / auditors"¹³. Many banks still ask for empanelled firms in their own policy. Check yours.
• Government and public sector work: often specifies empanelled auditors in the tender. Our guide to CERT-In guidelines, 6-hour reporting and VAPT audits covers where empanelment comes up.
• Most private SaaS firms: no rule requires it. Cybersecify notes the premium applies to regulated sectors, not typical SaaS startups³.

How many VAPT cycles will you actually pay for each year?

Regulated firms in India usually pay for two to four VAPT cycles a year, not one. RBI's 2026 Directions ask banks for vulnerability assessment every six months and penetration testing every 12 months on critical systems, plus testing after changes. SEBI and PCI DSS add their own cadence and change-driven tests.

Most price guides quote one engagement. Your budget has to cover a year. The number of cycles depends on your regulator, your systems and how often you ship changes.

The RBI Directions also say testing happens across the system life cycle: before go-live, after go-live on production, and after changes¹². If you ship a new customer-facing feature every quarter, that is more test events than the minimum. For a clause-by-clause view, see our guide to the RBI Cyber Security Directions 2026 VAPT rules.

The wider market already tests more than once a year. In Cobalt's 2025 survey of 450 security leaders and practitioners, quarterly was the most common cadence at 30%, while 27% tested annually and 15% semi-annually¹⁰.

What are the hidden costs of point-in-time testing?

The hidden costs of point-in-time VAPT are retest fees, staff time to fix and verify, repeat cycles for every change, and the exposure between tests. A test proves what was true on the days it ran. Findings then take weeks to close, while new code and new CVEs keep arriving between cycles.

1. Retests and fix verification

CyberSigma warns that retesting billed separately is a common surprise: the fix check you assumed was included "turns into a fresh invoice"⁶. Cybersecify says retests are commonly excluded or billed separately in the budget band³. PCI DSS expects you to retest and confirm corrections¹⁶, and SEBI expects findings closed within three months of the report¹⁵. So the retest is not optional. It is either in the price or on a second bill.

2. Your own team's time

Someone has to scope, grant access, answer tester questions, triage the report, fix the findings and chase the evidence. That time never appears in the vendor's quote. Fixes are slow for most teams. Cobalt found the median time to resolve findings of all severities was 67 days, and fewer than half (48%) of vulnerabilities were remediated¹¹.

3. Repeat cycles for every change

RBI asks for testing after changes, and PCI DSS asks for a pentest after significant changes¹²¹⁶. A team that ships a major release each quarter can end up buying extra engagements that were never in the annual budget.

4. Exposure between tests

This is the largest cost, and it is not on any invoice. With one test a year, the gap between tests is close to a full year. Verizon's 2026 DBIR found that exploitation of vulnerabilities was the top way into organisations, at 31% of breaches¹⁷. IBM puts the average cost of a breach in India at ₹25.5 crore in 2026, up 15.9% from ₹22 crore in 2025⁹. A ₹5 lakh test budget and a ₹25.5 crore average loss are not the same order of size. Our post on the 363-day blind spot of annual pentests walks through what happens in that gap.

What are the red flags in a cheap VAPT quote?

Cheap VAPT red flags include a full web application test priced under about ₹25,000, a report in two or three days, no named testers, no manual validation, no retest and no proof of exploit. TCSA says web app "pentests" quoted that low are almost always an automated scan export with a new cover page.

A low price is not always a bad sign. A small brochure site does not need a two-week test. The problem is when a scan is sold as a pentest, and your auditor or your attacker finds the difference. TCSA puts it plainly: a full web application "pentest" quoted under about ₹25,000 is almost always an automated scan export with a new cover page¹.

Watch for these signs:

• Scanner output relabelled. Findings read like tool plug-in names, with generic fixes and no screenshots from your app.
• No manual validation. False positives are left in. Real business logic flaws, like one customer seeing another's data, are missing.
• No authenticated testing. The vendor never asked for test accounts, so only the login page was tested.
• No retest. The quote ends at the first report, with no closure report for your auditor.
• No proof of exploit. High and critical findings have no steps to reproduce, no request and response, and no evidence of impact.
• No scoping call. A fixed price given before anyone asked about roles, endpoints or IPs.
• Timelines that do not add up. Published timelines for manual web app and API tests are 5 to 15 days³. A two-day turnaround on a large app means someone skipped the work.

If you want to know where tools stop and people start, our guide to automated vs manual penetration testing covers what each finds and misses.

What should you ask a VAPT vendor before you sign?

Before signing a VAPT contract, ask the vendor how many tester days are included, which roles and endpoints are in scope, how much is manual, whether one retest and a closure report are included, whether they are CERT-In empanelled, and to share a sample report with proof of exploit. The answers explain most price gaps.

• How many tester days are in this quote, and who are the testers? What certifications do they hold?
• Exactly what is in scope: which URLs, how many API endpoints, which IPs, which cloud accounts, which mobile builds?
• How many user roles will you test with authenticated sessions?
• Is this black, grey or white box? What access do you need from us?
• What share of the work is manual? Which test cases are manual only?
• Is one retest included? Do we get a closure report our auditor will accept?
• Are you on CERT-In's list of empanelled auditors today? Can we see the current listing?
• Will the report map findings to our framework (RBI, SEBI CSCRF, PCI DSS, ISO 27001)? Are findings CVSS scored?
• Can we see a redacted sample report with reproduction steps and evidence?
• Where does our data go during the test, and how is it deleted after?
• What does a rush timeline cost, and what depth do we lose?

Is continuous or automated testing cheaper over a year?

Continuous or automated testing can cost less over a year than several manual cycles, but only if you compare the same scope and depth. It shortens the gap between tests and speeds up retests. It does not replace an independent audit where a regulator requires one, and business logic still needs human testers.

There is no single answer, so here is a fair way to compare.

1. Count your real cycles. Use the table above. Two VA rounds, one PT, change-driven tests and retests add up. Price all of them, not just one.
2. Compare equal scope. A cheap scanner subscription is not the same as a manual pentest. A continuous platform that exploits and validates findings is not the same as a scanner either. Ask what each one proves.
3. Keep the audit you are required to have. If SEBI or your board needs a CERT-In empanelled audit, continuous testing sits alongside it, not instead of it.
4. Value faster fixes. Cobalt's 2026 report says 53% of organisations now take a programmatic approach to pentesting, and those firms are 4.5 times more likely to fix critical findings in three days or less¹⁹. Faster closure shrinks the exposure you carry.
5. Look at the spread. The same report found top performers reach a high-risk finding half-life of 10 days, while the bottom 10% take 249 days¹⁹. How often you test matters less than how fast you learn and fix.

A common pattern is a mix: continuous or frequent automated testing for coverage between audits, plus manual, empanelled testing where rules or risk require it.

Sources

1. TCSA, "VAPT Cost in India 2026: What Penetration Testing Should Actually Cost", 10 June 2026. tcsa.in
2. SquareOps, "VAPT Cost in India 2026: Full Price Guide", 7 August 2026. squareops.com
3. Cybersecify, "Penetration Testing Cost in India 2026", updated 9 September 2026. cybersecify.com
4. BM Infotrade, "VAPT Cost in India 2026", updated 9 July 2026. bminfotrade.com
5. Factosecure, "How Much Does VAPT Testing Cost in India in 2026? Complete Pricing Guide", 6 May 2026. factosecure.com
6. CyberSigma, "VAPT Cost in India: What Drives Penetration Testing Pricing", 29 June 2026. cybersigmacs.com
7. MyITManager, "VAPT Services India: Pricing and Compliance", reviewed June 2026. myitmanager.in
8. RingSafe, "VAPT Cost in India 2026: Honest Pricing Guide", updated 26 April 2026. ringsafe.in
9. IBM India Newsroom, "India Records its Highest Average Cost of a Data Breach at INR 25.5 Crore in 2026", 3 August 2026. in.newsroom.ibm.com
10. Cobalt, "State of Pentesting Report 2025" (Figure 5, pentest frequency), April 2025. resource.cobalt.io
11. Cobalt, "Key takeaways from the State of Pentesting Report 2025", 14 April 2025. cobalt.io
12. Reserve Bank of India, "Reserve Bank of India (Commercial Banks: Cybersecurity, Technology: Risk, Resilience and Assurance Framework) Directions, 2026", RBI/DoS/2026-27/410, 31 July 2026. rbi.org.in
13. TaxGuru, "RBI Issues NBFC Cybersecurity and Technology Risk Directions, 2026" (text of RBI/DoS/2026-27/461), August 2026. taxguru.in
14. SEBI, "Cybersecurity and Cyber Resilience Framework (CSCRF) for SEBI Regulated Entities", circular SEBI/HO/ITD-1/ITD_CSC_EXT/P/CIR/2024/113, 20 August 2024. sebi.gov.in (PDF)
15. SEBI, "Frequently Asked Questions on CSCRF", June 2025. sebi.gov.in (PDF)
16. PCI Security Standards Council, "PCI DSS v4.0.1", Requirements 11.3 and 11.4, June 2024. pcisecuritystandards.org
17. Verizon, "2026 Data Breach Investigations Report", 2026. verizon.com
18. CERT-In, "Empanelled Information Security Auditing Organisations", list maintained by CERT-In. cert-in.org.in (PDF)
19. Cobalt, "5 Key Takeaways from the 2026 State of Pentesting Report", 21 April 2026. cobalt.io