VAPT for web and mobile apps: what it is, when you need it and what it covers

Short answer: VAPT (vulnerability assessment and penetration testing) is a security test of your application. Automated scans find known weaknesses, then security testers try to break in the way an attacker would. Do it before launch, after major changes, at least once a year, and whenever a client, regulator or auditor asks for a report.

Vulnerability assessment and penetration testing

The two halves do different jobs:

• Vulnerability assessment uses scanners to find known weaknesses quickly and broadly: outdated software, missing security headers, weak settings.
• Penetration testing is manual. Testers chain small weaknesses together to show what an attacker could actually do, such as reading another user's data or taking over an account.

Scanners alone miss logic flaws, like a user changing an ID in a request to see someone else's order. That is why both are needed.

What gets tested

Web applications and APIs, against widely used checklists such as the OWASP Top 10:

• Broken access control, so users cannot see or change what is not theirs.
• Injection, such as SQL injection.
• Authentication and session handling.
• Security misconfiguration and outdated components.
• Exposure of sensitive data.

Mobile apps, against the OWASP Mobile Application Security Verification Standard (MASVS):

• How data is stored on the phone.
• How the app talks to the server.
• Whether the app can be reverse-engineered or tampered with.

Cloud and infrastructure: open ports, storage buckets, access keys and server settings.

When you need it

• Before launch, so you are not the first to find out.
• After major changes, such as new payment flows or new user roles.
• At least once a year, because new weaknesses are found all the time.
• When customers ask. Enterprise and government buyers often ask for a recent VAPT report, sometimes from a CERT-In empanelled auditor.
• For audits and certifications, such as ISO 27001.

What the report shows

A good report lists each finding with its severity (critical, high, medium or low), where it was found, evidence, the business impact and clear steps to fix it. After your team fixes the issues, the testers retest and confirm them in a final report.

Black box, grey box or white box

• Black box: testers start with no knowledge, like an outside attacker.
• Grey box: testers get user accounts for each role. This is the most common choice for apps.
• White box: testers also see the code and architecture, for the deepest review.

How to prepare

Agree the scope (apps, APIs, environments), testing windows and rules, and provide test accounts for each role. Test on a staging copy of production when you can, and make sure backups are in place.

After the test

Fix critical and high findings first, then retest. Then build security into everyday development: code review, dependency checks and secure defaults, so the next report is shorter. And plan your incident response: in India, CERT-In's directions require many organisations to report certain cyber incidents within six hours.

Humanoid Systems runs VAPT for web apps, mobile apps and APIs as part of our cyber security services. Ask us for a scoped proposal.