If a customer has asked you for a penetration test report before they sign, you are not in an unusual position any more. Here is what VAPT involves for an Indian SME, what it costs, and what you should expect to receive.
01 The trigger
Why the question is coming up
Two things are happening at once.
International buyers are asking for a VAPT report or a SOC 2 roadmap before they commit. If you sell into Europe, the US, Australia or the Gulf, expect the request, and expect it from companies that have never heard of your vendor until last week.
At the same time, most Indian SMEs are not careless. They are under-audited. The patterns repeat: default credentials still live on cloud consoles, old firewall rules are still open, contractor accounts from finished projects are still active, and backups are taken but never tested.
None of that needs an enterprise security programme to fix. It needs one proper assessment, an honest fix list, and somebody accountable for what happens next.
02 The work
What a penetration test actually covers
A scanner compares your environment against known vulnerability signatures. It is fast, it is cheap, and it finds what it already knows about.
A penetration test is human-led. A tester chains weaknesses the way an attacker would, works through the application logic, and looks for the paths a scanner cannot see. If your customer's review only needs an automated report, a scan may be enough. If you want to know your real exposure, the two are not the same product.
Scope usually covers external and internal testing, web applications, mobile apps, APIs and network infrastructure. Application source code is worth reviewing too. JavaScript, TypeScript, Python and SQL get read for the flaws automated scanners miss in logic and configuration.
Every finding should arrive with how to fix it, ordered by risk.
03 The money
What it costs in India
These are indicative 2026 ranges for the Indian market, not a Pinaka quote. Scope is what drives them:
| Engagement | What to expect in India |
|---|---|
| Web application penetration test Typical business application | ₹50,000 to ₹2.5 lakh |
| Mobile app testing | Higher — depends on number of apps, platforms and depth |
| Network plus application | Higher again — depends on number of hosts, apps, APIs and depth of testing |
Scope is the driver: how many apps, APIs and hosts, and how deep the testing goes. A smaller application with fewer endpoints and nothing worth chaining sits at the bottom of the range. Add internal network testing and a second application and it moves quickly.
We quote a fixed price after a short scoping call, so you know the number up front instead of a range that moves.
If you are comparing this against international pricing, our post on what a security audit (VAPT) costs covers the USD numbers and the five drivers behind them.
04 The process
How the process runs
- Scoping call. Fifteen minutes. We map the apps, APIs and infrastructure in scope and give you a fixed price, not a range.
- Testing. Hands-on testing against your live environment, on a schedule that suits your team. Usually one to three weeks.
- Report. Findings ranked by real risk, each with a clear fix. Written for your developers and for your auditor or customer, because those are two different readers.
- Fix and retest. We help you close the high-risk findings, then retest, so the report you send to a customer is a clean one rather than a record of what used to be wrong.
05 The report
What a report you can actually use looks like
- Ranked by risk, not by scanner severity. A long list sorted by CVSS score tells you very little about what to fix first.
- Every finding explains itself. What it is, how it was found, what it exposes, and how to fix it.
- Written for two audiences. The developer who has to fix it, and the customer who asked for it. A report only your engineers can read will not get you signed.
- A fix list that can be worked through, not a spreadsheet of two hundred rows with no order.
- A retest, so the copy you send out is the fixed version.
- Plain language. If the reader needs to already know security to understand the report, it is written for the wrong person.
If a provider will not show you a sample report from comparable work, that is worth asking about.
06 Where we start
A fixed price and a Bengaluru team
We are based in Bengaluru and work with companies across India, the UK, the US, Oman, Australia and New Zealand. Most of the work is remote, with on-site visits when a project needs them.
For Indian teams selling internationally, the report and the supporting documentation both have to hold up with an overseas customer or auditor. That is a specific kind of writing, and it is part of the engagement rather than an extra.
Tell us what you are running. We will scope it, give you a fixed price, and tell you what matters most. Our cybersecurity in India page has the service detail.
