How much does a VAPT cost for a small business in Kerala?
Key takeaways
- A focused VAPT for a Kerala small business starts at Rs 60,000 excluding 18% GST, covering the external perimeter and the web application.
- Internal network and Active Directory testing is where the Rs 1,50,000-6,00,000 band begins, and most small Kerala firms do not need it in year one.
- Credential-stuffing and business email compromise checks cost little relative to the payment fraud they prevent, which is the most common loss route for a small Indian firm.
- A fixed price quoted after a scoping call is normal; a price quoted before any questions about your systems are not.
- Retest after remediation is included as standard at AAVETech, so the engagement ends with evidence of closure rather than an open list.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What should a small Kerala business actually test first?
Test the two paths that reach the money. For a small firm, the first path is business email compromise, where an attacker takes over a finance or sales mailbox and asks a real colleague to make a genuine transfer. The second is credential stuffing against any customer-facing login, because reused passwords turn a breach at a small supplier into an entry at your door. Everything else in a large assessment is valuable but downstream of these two. If budget forces a choice, spend it on the paths that move money rather than on breadth.
How do you know the price you have been quoted is fair?
Compare three things: the tester-day rate, which sits at roughly Rs 12,000 to Rs 30,000 before GST; the number of tester-days, which should appear in the proposal; and the retest policy. A quote below the rate band is not cheap, it is thin, and the saving appears later as an untested application. A fair proposal names the number of tester-days, the number of roles tested, the environments covered and the date the report lands.
Is a free security scanner enough for a small business?
No, and this is the most common false economy in small-business security. A scanner maps known weaknesses against known version numbers. It cannot find broken access control between two roles, cannot find a business logic flaw, and cannot chain four low-severity issues into a full compromise path. Those are where small firms lose money. A scanner is worth running as preparation, because it reduces the noise a tester has to wade through, but it is not a substitute for a test and should never be reported to a customer as one.
What does the engagement look like in practice?
A short scoping call where we look at your systems and describe a useful test. Then a written rules-of-engagement document naming every system, the test window and the contact. Then testing inside that window, with a live finding log you can query during the engagement. Then a technical report, a one-page executive summary, your fixes, and a retest that lists every finding as closed, partial or open. The whole cycle for a small Kerala business is usually two to three weeks.
| Item | Indicative range (ex-GST) | Priority |
|---|---|---|
| External network and web application VAPT | Rs 60,000 - 1,50,000 | First |
| Business email compromise assessment | Included in above | First |
| Phishing simulation for staff | Rs 25,000 - 60,000 | First |
| Staff awareness training session | Rs 15,000 - 40,000 | First |
| Incident response retainer | Rs 2,50,000 - 6,00,000 / year | Second |
| Internal network and Active Directory test | Rs 1,50,000 - 6,00,000 | Second |
What are the frequently asked questions?
Get a straight answer on this
Book a free 30-minute scoping call. Bring your application list and your user roles, and you will get a fixed price and a start date.
Send us the details See pricing