Short answer: The VAPT process runs in seven phases — scoping and authorization, reconnaissance, scanning and enumeration, exploitation, post-exploitation, reporting, and free retest. Each phase feeds the next, following OWASP methodology and scoring every finding with CVSS so risks are prioritised objectively rather than by guesswork.
What is the VAPT process?
VAPT (Vulnerability Assessment and Penetration Testing) is a structured, repeatable engagement — not a single tool run. A professional VAPT combines the breadth of a vulnerability assessment (finding as many weaknesses as possible) with the depth of a penetration test (proving which weaknesses are genuinely exploitable). The methodology below is how serious providers, including Cyber Defence, actually work in 2026.
The 7 phases of VAPT
Phase 1: Scoping and authorization
Nothing starts without a signed scope and written authorization. This is both good practice and a legal requirement — testing systems without permission is illegal. In this phase we agree:
- exactly which applications, URLs, IP ranges, APIs or cloud accounts are in scope (and what is explicitly out of scope);
- the testing window and whether it is black-box, grey-box or white-box;
- credentials for each user role (for authenticated testing);
- rules of engagement — rate limits, no destructive tests on production data, escalation contacts;
- compliance goals (ISO 27001, PCI-DSS, DPDP Act 2023 readiness).
The output is a documented scope and a get-out-of-jail authorization letter. If a vendor skips this, walk away.
Phase 2: Reconnaissance
Reconnaissance is information gathering — mapping the attack surface before touching it aggressively. Testers enumerate subdomains, technologies, exposed services, endpoints, and publicly leaked information (credentials in code repos, metadata, DNS records). Good recon is what separates a thorough test from a shallow one; you cannot test what you have not found.
Phase 3: Scanning and enumeration
Here automated tools do the heavy lifting of breadth. Vulnerability scanners, directory brute-forcers and service fingerprinters identify candidate weaknesses across the mapped surface. Enumeration digs deeper into each service — versions, configurations, open ports, parameters. The result is a long list of potential issues that the tester will then validate by hand. Tools here are a starting point, not the conclusion.
Phase 4: Exploitation
This is the "penetration testing" heart of VAPT. The tester manually attempts to exploit the candidate vulnerabilities to prove they are real and to understand their impact. This includes:
- injection attacks (SQL, command, template);
- broken access control — IDOR/BOLA, privilege escalation, forced browsing;
- authentication and session weaknesses;
- business-logic abuse (e.g. manipulating a checkout to pay less);
- server-side request forgery, insecure deserialization, and more.
Manual exploitation is where false positives are eliminated and where the flaws automated tools cannot understand — logic and authorization bugs — are discovered. This follows the OWASP Testing Guide and, for APIs and mobile, the OWASP API Security Top 10 and MASVS.
Phase 5: Post-exploitation
Once access is gained, the tester assesses how far the compromise could go: can privileges be escalated, can other systems be reached (lateral movement), what sensitive data is exposed, and how persistent could an attacker become? This phase answers the business question — "so what?" — by showing the real-world impact of a foothold, always within the agreed rules of engagement and without damaging production data.
Phase 6: Reporting
The deliverable that matters. A professional VAPT report includes an executive summary for management, a technical body with each finding, its CVSS score, reproduction steps, evidence, and a specific remediation recommendation, plus a prioritised action plan. Findings are ranked so your team fixes the most dangerous issues first. We cover the full anatomy in what is VAPT.
Phase 7: Free retest
A test that ends at the report leaves you guessing whether your fixes worked. In a complete engagement, after your developers remediate, the tester re-verifies each finding. Confirmed fixes are marked closed; anything still open is flagged. On a clean retest, Cyber Defence issues a VAPT completion certificate. The retest is included, not an upsell.
How CVSS scoring prioritises risk
Every finding is scored using the Common Vulnerability Scoring System (CVSS), which produces a 0.0–10.0 severity based on factors like attack vector, complexity, privileges required and impact on confidentiality, integrity and availability.
| CVSS score | Severity | Typical response time |
|---|---|---|
| 9.0 – 10.0 | Critical | Fix immediately / block release |
| 7.0 – 8.9 | High | Fix within days |
| 4.0 – 6.9 | Medium | Plan a fix soon |
| 0.1 – 3.9 | Low | Fix when convenient |
CVSS turns "this feels bad" into an objective, comparable number, so remediation effort goes where it matters most.
Vulnerability assessment vs penetration testing within VAPT
VAPT deliberately combines two complementary activities, and understanding the split explains why the process has the phases it does. The vulnerability assessment side (recon, scanning, enumeration) is about breadth — casting a wide net to find as many potential weaknesses as possible across the whole surface. The penetration testing side (exploitation, post-exploitation) is about depth — proving which of those weaknesses are genuinely dangerous and how far an attacker could get.
A vulnerability assessment alone gives you a long list with false positives and no proof of real impact. A penetration test alone might go deep on a few paths but miss breadth. Doing both, in sequence, is what makes VAPT trustworthy: you get comprehensive coverage and validated, prioritised risk. This is also why a purely automated scan cannot be called VAPT — it delivers only the breadth half, and even that with false positives.
What happens after the report is delivered
The engagement does not end when the PDF arrives. A responsible process supports you through remediation:
- Debrief call: the tester walks your team through the critical and high findings so nothing is misunderstood.
- Remediation window: your developers fix issues, able to ask the tester follow-up questions on reproduction and fixes.
- Retest: the tester re-verifies each finding and updates its status.
- Certificate and closure: on a clean retest, a completion certificate is issued and the engagement is formally closed.
This closing loop is what turns testing into an actual security improvement rather than a document that sits in a drawer.
Black-box, grey-box or white-box?
- Black-box: tester has no inside knowledge, simulating an external attacker. Realistic but slower and may miss deep flaws.
- Grey-box: tester has some access (e.g. user credentials). The best balance for most web and API engagements.
- White-box: tester has full access including source and architecture. Most thorough, ideal for critical systems.
Most commercial engagements are grey-box because it finds the most real risk per rupee spent.
What you need to prepare before a VAPT starts
A smooth engagement depends on what you hand the testers up front. Preparing these in advance shortens the timeline and improves coverage:
- Clear scope: the exact URLs, IP ranges, API base paths, mobile builds or cloud accounts to be tested.
- Test credentials: a working account for each user role, ideally in a staging or dedicated test environment.
- API documentation: Swagger/OpenAPI specs or a Postman collection dramatically improve API coverage.
- A test environment: a staging copy that mirrors production is safest; if production must be tested, agree strict rules on destructive actions and data.
- Points of contact: someone reachable during the testing window in case something needs pausing or escalating.
- Known issues: sharing anything you already suspect saves time and focuses effort.
Common mistakes that weaken a VAPT
Even a well-run methodology can be undermined by avoidable process mistakes. Watch for these:
- Scoping too narrowly to save money, so the most exposed systems are left untested.
- Unauthenticated-only testing, which misses the bulk of access-control and business-logic flaws.
- Treating the scanner output as the final result instead of validating each candidate finding by hand.
- Skipping the retest, so nobody confirms the fixes actually worked.
- No remediation ownership, where the report is filed and forgotten instead of driving fixes.
A disciplined provider guards against all of these — the process only delivers value if every phase is completed honestly.
How the phases map to compliance
Each phase produces evidence that compliance frameworks expect. Scoping and authorization document due diligence; methodology alignment shows rigour; CVSS-scored findings and the remediation plan demonstrate risk management; and the retest with certificate proves closure. This chain of evidence is what an ISO 27001 assessor, a PCI-DSS QSA, or a DPDP Act 2023 due-diligence reviewer wants to see. A VAPT that skips phases leaves gaps in that evidence trail.
Standards and frameworks we align to
A credible VAPT methodology maps to recognised frameworks: the OWASP Testing Guide and OWASP Top 10 for web, OWASP API Security Top 10, OWASP MASVS for mobile, PTES (Penetration Testing Execution Standard), and CIS Benchmarks for cloud and configuration review. Aligning to these makes findings defensible in an ISO 27001 or PCI-DSS audit and supports DPDP Act 2023 due diligence.
Cyber Defence is ISO-certified and GeM-registered, led by Amit Kumar (CEH, CRTA). In the interest of honesty, we are not CERT-In empanelled and do not claim to be. Explore our VAPT services in Haryana and VAPT services in Delhi, or build the skills yourself through our VAPT training.
FAQ
What are the phases of the VAPT process?
Seven phases: scoping and authorization, reconnaissance, scanning and enumeration, exploitation, post-exploitation, reporting, and a free retest to verify fixes.
How long does a VAPT engagement take?
A medium web application typically takes one to two weeks including reporting. Larger, multi-app or full-scope enterprise engagements take longer. The scoping call sets a realistic timeline.
What is the difference between vulnerability assessment and penetration testing?
Vulnerability assessment finds as many weaknesses as possible (breadth); penetration testing proves which are truly exploitable and how far they go (depth). VAPT combines both. See our full comparison for details.
What is CVSS scoring in VAPT?
CVSS is a standard 0.0–10.0 scoring system that rates each finding's severity based on how easy it is to exploit and how much damage it causes, so you fix the most dangerous issues first.
Is authorization really required before testing?
Yes. Testing any system without written authorization is illegal. A signed scope and authorization letter is the mandatory first phase of any legitimate VAPT.
Does the VAPT process include a retest?
In a complete engagement it should. Cyber Defence includes a free retest after remediation and issues a completion certificate on a clean result.
Want a VAPT run properly, phase by phase, with a free retest included? Call Cyber Defence at +91-75175-72000.