VAPT stands for vulnerability assessment and penetration testing. The two are related but different, and buying the wrong one is a common and costly mistake.
Vulnerability assessment vs penetration test
- A vulnerability assessment uses tools and review to find and rank known weaknesses across many assets. It is broad and repeatable.
- A penetration test uses a skilled tester to exploit weaknesses and chain them together, showing what an attacker could actually reach. It is deeper and goal-driven.
What can be in scope
Typical targets are web applications, APIs, internal and external networks, cloud environments, mobile applications and identity systems such as Active Directory, Entra ID and single sign-on. Each needs different techniques, which is why the scope must say exactly what is included.
The phases of an engagement
- Scoping and rules of engagement: targets, dates, permitted techniques, contacts and emergency stop.
- Information gathering and mapping of the attack surface.
- Testing and exploitation, with manual work as well as tools.
- Reporting: an executive summary, technical findings with evidence, risk ratings and fixes.
- Retest: confirming that the fixes actually worked.
Questions that make a scope useful
- What are the most valuable assets and what would hurt most if they were compromised?
- Will testing be done from the internet, from inside the network, or both?
- Is a credentialed test (with logins at different privilege levels) needed for applications?
- Are production systems in scope, and what are the safe-testing windows?
- Which standard or customer requirement needs the report?
How often
Test at least annually, after major changes, and before launching new internet-facing applications. Between tests, keep vulnerability scanning running so new issues do not wait a year to be found.
Sentinel BT offers VAPT across web, API, network, cloud, mobile and identity. To scope an engagement, email [email protected].