What is the difference between a penetration test and a vulnerability assessment?
Key takeaways
- A vulnerability assessment is breadth: it finds and ranks weaknesses across an estate, largely with automated scanners.
- A penetration test is depth: it proves exploitability and hands you a working attack path instead of a findings list.
- Automated scanners are weakest on broken access control between user roles, business-logic abuse and chained low-severity findings.
- Indian VAPT is priced at roughly Rs 12,000-30,000 per tester-day, plus 18% GST, so a low quote usually means a narrow scope.
- The cheapest sensible sequence for an Indian SME is an assessment to map, a test to prove, then a retest to evidence closure.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What does each one actually deliver?
The assessment answers the question how big is the problem. It enumerates hosts, applications, configurations and known weaknesses, assigns each a severity, and produces a prioritised list that a team can work through. The penetration test answers a different question: can this actually be exploited, and how far would an attacker get. Its output is an attack path, screenshots of the real sequence, and a proof that a low-severity misconfiguration combined with a weak password resets a finance administrator account. Indian buyers often need both, because the assessment list is what a board reads and the attack path is what a developer can act on.
How can you tell a real test from a relabelled scan?
Ask for the methodology and the tester-day count, then look for three things in a sample report: manual steps a developer could repeat, evidence such as request and response pairs, and a business impact statement that is not a copy of a CVSS vector. A scan relabelled as a penetration test usually contains plugin names, severity scores from a tool, and no narrative of how an attacker moves from one weakness to the next. If the vendor cannot name the tester-day rate, the number of roles being tested or the retest policy, you are looking at a tool run, not an engagement. No sample report means no way to tell.
When will a compliance report not satisfy a customer?
When the customer asks how you tested, what you found and whether it is fixed, a generic compliance attestation often fails the procurement check. Indian enterprise buyers increasingly ask their suppliers for evidence of a recent penetration test, and they want the report or at least the executive summary with dates, scope and remediation status. A CERT-In aligned report with a retest outcome answers that. A one-page attestation that says the system was assessed will not. Ask the vendor whether the deliverable is a report, a certificate or a letter, because those are three different products and the certificate is the one that carries no technical content.
What sequence reduces the total cost?
Start with an external perimeter and application assessment to remove the obvious, then test what remains, then retest only the fixed items rather than the whole estate again. For most Indian SMEs this costs materially less than one large test, because the retest is scoped to the findings list and runs in a few days. It also produces a better remediation record, since every finding leaves the report as closed, partial or open. We run assessment work at a fixed price with a retest after your fixes included as standard, because a finding that is never re-tested is an open question rather than a closed one.
| Dimension | Vulnerability assessment | Penetration test |
|---|---|---|
| Primary question | How many weaknesses exist and how serious are they? | Can it be exploited, and how far would an attacker get? |
| Method | Mostly automated scanning plus configuration review | Manual, goal-directed testing with human judgement |
| Typical duration | 3-7 working days for a mid-size estate | 5-20 working days depending on roles and depth |
| Indicative cost (ex-GST) | Rs 40,000 - 1,50,000 | Rs 60,000 - 6,00,000 |
| Deliverable | Ranked findings list with severity | Attack path, evidence, proof and retest status |
| Blind spots | Business logic, role abuse, chained weaknesses | Breadth across a large estate if scope is narrow |
What are the frequently asked questions?
Get a straight answer on this
Send us your application count and user-role count, and we will return a fixed price and a start date for the assessment and test within one working day.
Send us the details See pricing