Services · Security
VAPT cost in India: what firms publish, and what moves it
Real published ranges with their sources, and how to spend less without wasting the money.
A VAPT of one small or typical web application in India is published at about ₹25,000 to ₹1.5 lakh, and full infrastructure at several lakh. What moves the price is how much is in scope and how much is tested by hand.
Before paying anyone, use the free audit and the free quote review below.
What other firms publish
| What is tested | Wattlecorp (27 April 2026) | TCSA (10 June 2026) |
|---|---|---|
| Small website or basic app | ₹25,000 to ₹60,000 | ₹40,000 to ₹1.5 lakh (typical web app) |
| Medium web application | ₹60,000 to ₹1,50,000 | ₹40,000 to ₹1.5 lakh (typical web app) |
| Larger web application | ₹1,50,000 to ₹4,00,000 and above | Enterprise scopes higher |
| Mobile application | ₹60,000 to ₹2,00,000 | ₹50,000 to ₹1.5 lakh per platform |
| API | Not listed | ₹40,000 to ₹1.2 lakh |
| External network | ₹40,000 to ₹1,20,000 | ₹30,000 to ₹1 lakh |
| Internal network | ₹80,000 to ₹2,00,000 | ₹60,000 to ₹2 lakh |
| Cloud | ₹1,00,000 to ₹5,00,000 and above | ₹50,000 to ₹1.5 lakh per environment |
These are those firms' own indicative figures, read 4 November 2026, and we are not affiliated with them. Astra, another firm, says Rs 40,000 to Rs 8,50,000 for a single scan in an article last modified on 17 February 2026. One firm reports two quotes for one application of ₹90,000 and ₹6,80,000, which is why scope matters more than any table.
What moves the price
- Size: pages, API endpoints, user roles, IP addresses.
- Depth: an automated scan, or a person trying to break in.
- What you give the tester: nothing, a login, or the code.
- The retest: in the price, or charged again?
- The name on the report: an empanelled auditor can cost more, and you may need one.
How to keep it low without wasting it
- Fix what the free check finds first, so you do not pay someone to tell you.
- Test the part that holds money or customer data; leave out the rest.
- Give the tester a login: grey-box testing finds more in fewer hours.
- Get one retest in the quote.
- Ask us to review a quote you already have. That is free too.
Sources
- Wattlecorp: VAPT cost in India — read 4 November 2026
- TCSA: VAPT cost India 2026 — read 4 November 2026
- Astra: VAPT pricing — read 4 November 2026
- Cost drivers and quote spread: api4soc — read 4 November 2026
What this is not
Said plainly
- The Nivasik Team is not a CERT-In empanelled auditor and holds no security certification. If a regulator or customer asks for a report from an empanelled auditor, or for a certificate, that comes from them, not from us.
- No test proves a system is safe. It shows what was found, in the time and scope agreed.
- Nothing is guaranteed: not a pass, not a certificate, not a result.
Questions people ask
How much does VAPT cost in India?
Firms publish about ₹25,000 to ₹1.5 lakh for one small or typical web application, more for large ones, and lakhs for full infrastructure. These are their own marketing figures. Your scope decides the real number.
What is the cheapest VAPT?
We do not claim to be the cheapest, and be careful with whoever does: a very low price is often an automated scan with a report template. Ask whether a person tests by hand and whether a retest is included.
Is there a free VAPT?
Not a real one with a report. There are free scanners, and we offer a free audit of one website or app, which is a useful first look and not a VAPT.
What do you charge?
We quote per engagement, in writing, after a call, with one retest in the quote. We do not publish one price, because scope changes it too much for a number to be honest.
Can you look at a quote I already have?
Yes, free. Send it and we will tell you whether the scope makes sense and what you could leave out.
Does GST apply to VAPT?
Yes, GST normally applies to the service. Several published ranges do not say whether they include it, so ask.
Ask for it
We reply within a day. Your details go to the Nivasik Team and nowhere else.