A VAPT quote is a guess until the scope is written down.

It depends on scope and depth, which is why we do not publish a price list: one figure would be wrong for most readers. What you pay for is skilled tester-days, plus reporting and a retest. The days come from the scope units — external IPs, internal hosts, web applications by roles and workflows, API endpoints, mobile platforms — and from whether testers get accounts and documentation. We scope in a 30-minute call at no charge, then send a written scope and a fixed price with a retest included. See our VAPT service.

By the work behind the login, not the number of pages. The cost drivers are the number of user roles to test as, the workflows that handle money or data — payments, uploads, approvals, exports — integrations with other systems, and whether one customer’s data could be reached by another. Each extra role multiplies the access-control checks. Have one test account per role and a list of key workflows ready, and ask each supplier how many days they plan per role. Our web application testing page describes what that testing covers.

Often, for external networks, and that is reasonable when the work really is per address: discovering services on each live IP, then verifying and exploiting what matters. It stops being meaningful for applications, where effort depends on roles and workflows, and for internal networks, where Active Directory and segmentation drive the days. A low per-IP price over a large range can also mean scan-only work. Ask what is done on each address beyond the scan. Network penetration testing explains how we approach perimeter and internal scope.

When a rule or a contract says so. CERT-In’s June 2023 guidelines require central government entities to have every application and website audited by an empanelled organisation before hosting, yearly and after major changes. SEBI’s CSCRF requires its audits, VAPT included, to be done by empanelled auditors, with a three-year limit on using the same one. Tenders and contracts often add the requirement. Otherwise you may choose any competent tester. SemperWise is not empanelled: where it is required, you appoint the empanelled auditor directly, and we prepare you and verify fixes in between.

Usually because it is pricing less work. The commonest reasons: it is an automated scan relabelled as VAPT; it plans fewer days for the same scope; it tests without logging in; it excludes the retest; or it imagined a smaller scope than you did. NIST notes scanners have high false-positive rates and need expert interpretation, and the PCI Security Standards Council puts a scan at seconds to minutes per host against days or weeks for a penetration test. Ask every supplier for days per target and a redacted sample report, then compare.

In every SemperWise testing engagement, yes — one retest of your fixes, with the result recorded against each finding. Elsewhere, ask, because some quotes treat a retest as a new engagement. CERT-In’s July 2025 audit guidelines expect follow-up audits to be written into the scope, carried out after vulnerabilities are closed, and the final report issued only after that follow-up. A test without a retest leaves you with a list of problems and no evidence any were fixed, which is rarely what a customer or auditor wants to see.

At least once a year for most organisations — the minimum CERT-In’s 2025 audit guidelines expect, which sectoral regulators can raise. SEBI requires VAPT twice a year for entities identified as protected systems or critical information infrastructure. Central government entities must also test after any major change. In practice, test whenever something significant ships: a new portal, a payment flow, a major release. Teams that deploy weekly usually find continuous penetration testing cheaper per release than a single annual test that is out of date within weeks.

Send every supplier the same written scope — the worksheet on this page — and ask each for days per target, the approach (black, grey or white box), which roles they will test as, the environment, whether the retest is included, and a redacted sample report. Then compare days before prices: two quotes with similar days and different prices are a price comparison; two with very different days are two different tests. Also ask who will do the work. For empanelled audits, CERT-In says the team should not include freelancers, interns or third-party consultants.