In short
Vulnerability Assessment and Penetration Testing (VAPT) is an independent security test of a website, app, API, network or cloud setup. A vulnerability assessment (VA) finds and rates known weaknesses. A penetration test (PT) tries to exploit them, the way a real attacker would. No single law defines VAPT, but government website rules, RBI, SEBI and many client contracts require it at fixed intervals. For software teams, the test is the easy part: the work is fixing findings, re-testing and keeping proof.
Who it applies to
Who needs it, and who asks for it:
- Government websites and apps. GIGW 3.0 guideline 5.3.1 requires a security audit and an audit clearance certificate before hosting in production. It must come from NIC, STQC, an STQC-empanelled lab or a CERT-In empanelled lab. The site must be re-audited at least once a year, or sooner when source code changes. See government projects.
- Banks, NBFCs and other RBI-regulated entities. The RBI Master Direction on IT Governance (7 November 2023, in force from 1 April 2024) covers commercial banks, NBFCs in the top, upper and middle layers, credit information companies and all-India financial institutions. Critical systems, and customer-facing systems in the DMZ, need VA at least every six months and PT at least every 12 months. Testing is also needed before and after go-live and after major changes. See RBI IT governance.
- SEBI-regulated entities. Under the Cybersecurity and Cyber Resilience Framework (CSCRF, 20 August 2024), the auditor must be CERT-In empanelled. Exchange circulars for FY 2025-26 set VAPT once a year for most entities. Qualified Stock Brokers and entities identified as protected systems or critical information infrastructure test half-yearly. See SEBI CSCRF.
- Insurers and insurance intermediaries. IRDAI’s Information and Cyber Security Guidelines, 2023 require an annual independent assurance audit. Check the current IRDAI circular for VAPT frequency. See IRDAI cyber security.
- Private businesses. No general law forces VAPT on them, but enterprise clients, vendor questionnaires, ISO 27001 programmes and PCI DSS assessments regularly ask for a recent report.
What it means for your website
- The public site is the first target. Testers check forms, logins, admin panels, file uploads, APIs behind the site, hosting, TLS settings and security headers.
- Government sites cannot go live without clearance. The audit is usually done on a staging copy before hosting. The clearance is tied to the build that was audited.
- Code changes reopen the question. GIGW asks for a re-audit when source code changes, so plan releases around it. Small fixes made after the audit can mean a fresh test.
- Third-party scripts count. Chat widgets, analytics tags and payment scripts run inside your pages. Software supply chain failures are now third in the OWASP Top 10:2025.
What it means for your software
VA, PT and the three test approaches
A VA is broad: scanners and manual checks list known weaknesses and rate them. A PT is deep: a tester tries to get in and shows what they reached. Tests are run in one of three ways:
- Black box: the tester gets no inside information, like an outside attacker.
- Grey box: the tester gets user accounts for each role and some documentation. This suits ERP, CRM and portals, where most risk sits behind the login.
- White box: the tester also sees source code and architecture. It finds more, faster.
Scope: what gets tested
SEBI’s CSCRF scope is a good checklist for any business. It covers infrastructure VA (internal and external), application VA, external PT, Wi-Fi, API security, network segmentation, mobile apps, operating systems and databases, cloud deployments and configuration audits. A web app test that skips the APIs behind it, or the mobile app that uses them, leaves the same doors open.
What testers test against
- OWASP Top 10:2025 lists the most critical web risks: Broken Access Control, Security Misconfiguration, Software Supply Chain Failures, Cryptographic Failures, Injection, Insecure Design, Authentication Failures, Software or Data Integrity Failures, Security Logging and Alerting Failures, and Mishandling of Exceptional Conditions.
- OWASP ASVS 5.0.0 (Application Security Verification Standard, published 30 May 2025) gives detailed, testable requirements. It is also useful as a build specification.
- OWASP MASVS (Mobile Application Security Verification Standard) covers mobile apps: storage, cryptography, authentication, network, platform, code, resilience and privacy.
- Formal methods named by SEBI include NIST SP 800-115, OSSTMM, the OWASP Testing Guide and CERT-In guidelines.
What a VAPT report contains
A usable report has an executive summary, the scope and any exclusions, the tools used, and each finding with its severity. Severity is usually critical, high, medium or low, often scored with CVSS (Common Vulnerability Scoring System). Each finding should show the affected asset, evidence or proof of concept, the risk and the fix. SEBI’s format adds an auditor’s declaration and closure timelines, and SEBI entities must keep detailed reports with proofs for at least three years.
Fixing, re-testing and closure
RBI requires vulnerabilities to be fixed within a set time, and known ones kept from coming back. SEBI requires a revalidation report from the auditor showing closure status. In practice, the auditor re-tests each fix, and only then issues a clean report or certificate. Track every finding to closure with an owner and a date, and keep the change history that shows what was fixed.
Building software that passes
Most findings in business systems are predictable. Enforce role checks on the server for every request, not just in the menu. Validate all input and use parameterised queries. Keep libraries patched and know what you depend on. Log security events and alert on them. Handle errors without leaking stack traces or data.
Checklist
- Find out who requires your VAPT: GIGW, RBI, SEBI, IRDAI or a client contract, and note the frequency and auditor rules.
- List every asset in scope: websites, APIs, mobile apps, servers, databases and cloud accounts.
- Choose an auditor who meets the rule, for example CERT-In empanelled for SEBI or government work.
- Prepare a staging environment that matches production, with test accounts for each role.
- Agree the test approach (black, grey or white box) and the standards used, such as OWASP ASVS and MASVS.
- Assign an owner and deadline to every finding, starting with critical and high.
- Get the fixes re-tested and collect the closure or revalidation report.
- Store reports, evidence and fix history for as long as your regulator requires.
- Re-test after major changes, not just on the calendar date.
How Kreon helps
Systems Kreon has built have passed independent VAPT, and we build role-based access, logging and a full audit trail into the ERP, CRM and web systems we deliver. We can prepare your system and staging environment for an auditor, then fix the findings before the re-test. Kreon is not an empanelled auditor, so the test itself should come from an independent firm.