Cybersecurity & VAPT Knowledge Hub
Straight answers to the questions buyers, engineers and auditors ask about security testing.
This knowledge hub explains vulnerability assessment and penetration testing (VAPT), application security testing, software composition analysis, DevSecOps and compliance testing in plain English. Each guide opens with a direct answer, then covers the process, comparisons, checklists and FAQs, with links to the standards behind them such as OWASP, NIST and PCI DSS.
VAPT
What is VAPT? Vulnerability Assessment and Penetration Testing explained
VAPT stands for Vulnerability Assessment and Penetration Testing. It is a two-part security test: a vulnerability assessment scans systems to find and rank known weaknesses, and a penetration test has certified ethical hackers safely exploit those weaknesses to prove real business impact. Together they show what is vulnerable and what an attacker could actually do.
Read the guideVulnerability assessment vs penetration testing: what is the difference?
A vulnerability assessment identifies and ranks as many known weaknesses as possible, mostly with automated scanners. A penetration test goes deeper: a human tester exploits selected weaknesses to prove what an attacker could actually achieve. Vulnerability assessments give breadth and should run often; penetration tests give depth and proof, usually annually or after major changes.
Read the guideHow much does VAPT cost? Pricing factors explained
VAPT cost depends mainly on scope and effort — the number of applications, user roles, API endpoints, IP addresses or cloud accounts — and on whether testing is black, grey or white box. A small web application usually needs a few tester-days, while enterprise networks and multi-app programmes need several weeks. Always ask for a fixed-fee quote based on a scoping call.
Read the guideHow often should penetration testing be done?
Penetration testing should be done at least once a year and after every significant change, such as a major release, new infrastructure, a cloud migration or an acquisition. High-risk or fast-moving organisations — fintech, SaaS and e-commerce — often test twice a year or per major release, with continuous vulnerability scanning in between.
Read the guideVAPT methodology: the penetration testing process step by step
A professional VAPT methodology follows six phases: scoping and rules of engagement, reconnaissance, vulnerability discovery, exploitation, post-exploitation, and reporting with re-testing. Recognised standards that define these phases include PTES, NIST SP 800-115, the OWASP Web Security Testing Guide and OSSTMM, with findings scored using CVSS and mapped to MITRE ATT&CK.
Read the guideHow to choose a VAPT company: 10 questions to ask
Choose a VAPT company that uses certified testers (such as OSCP or CEH), follows a documented manual methodology (PTES, NIST SP 800-115, OWASP), shows a sample report with CVSS-scored, reproducible findings, includes re-testing, maps results to your compliance frameworks, and has clear data-handling and legal authorisation processes.
Read the guideWhat is included in a VAPT report? Format and sample structure
A good VAPT report contains an executive summary for leadership, the scope and testing window, methodology and standards used, a risk-rated list of findings with CVSS scores, evidence and reproduction steps, business impact, specific remediation guidance, and a re-test section confirming which issues have been fixed.
Read the guideWhat is vulnerability management? Lifecycle, prioritisation and remediation
Vulnerability management is the continuous process of discovering assets, scanning them for vulnerabilities, prioritising findings by risk, remediating or mitigating them, and verifying the fix. Unlike a one-off vulnerability assessment, it is an ongoing programme with defined owners and remediation timelines.
Read the guideHow to prepare for VAPT, penetration testing or a security audit
To prepare for VAPT, agree the scope and rules of engagement, provide test accounts for every role and API documentation, choose a stable test environment, take backups, whitelist tester IPs where appropriate, name a technical contact, and plan time for remediation and re-testing.
Read the guideWeb Security
Web application VAPT checklist (OWASP Top 10 aligned)
A web application VAPT checklist covers information gathering, configuration, authentication, session management, authorisation (IDOR and privilege escalation), input validation (SQL injection, XSS, command injection, SSRF, XXE), file uploads, business logic, cryptography, error handling and API security — aligned to the OWASP Top 10 and the OWASP Web Security Testing Guide.
Read the guideWhat is the OWASP Top 10? A plain-English guide
The OWASP Top 10 is a regularly updated list, published by the Open Worldwide Application Security Project (OWASP), of the ten most critical security risks to web applications — including broken access control, cryptographic failures, injection, insecure design and security misconfiguration. Organisations use it as a minimum baseline for secure development and penetration testing.
Read the guideMobile Security
API & Cloud
What is API penetration testing? API security checklist
API penetration testing is a manual security test of an application programming interface — REST, GraphQL or SOAP — that tries to break authentication, authorisation, input handling and business logic the way an attacker would. It is aligned to the OWASP API Security Top 10, where broken object-level authorisation (BOLA) is the leading risk.
Read the guideCloud security checklist and cloud penetration testing methodology
A cloud security checklist verifies identity and access management, storage exposure, network controls, workload and Kubernetes configuration, encryption and key management, and logging and detection across AWS, Azure or GCP. Cloud penetration testing then attempts to exploit misconfigurations to prove which attack paths are real.
Read the guideSCA & DevSecOps
Compliance
VAPT requirements for compliance: PCI DSS, SOC 2, ISO 27001, HIPAA, GDPR and NIST
PCI DSS explicitly requires penetration testing at least every 12 months and after significant changes, plus quarterly vulnerability scans. ISO 27001 and SOC 2 do not name penetration testing, but VAPT is the standard evidence for their vulnerability-management and security-testing controls. GDPR Article 32 requires regular testing of security measures, and NIST, CMMC and DORA all expect ongoing security testing.
Read the guideWhat is ISO 27001? ISMS, certification and why it matters
ISO/IEC 27001 is the international standard for establishing, implementing, maintaining and continually improving an information security management system (ISMS). It requires organisations to assess information security risks and treat them with appropriate controls, and it can be independently certified by an accredited certification body.
Read the guideHow to implement ISO 27001: step-by-step implementation checklist
To implement ISO 27001, define the ISMS scope, perform a gap analysis, run a risk assessment, choose controls and document them in a Statement of Applicability, implement policies and controls, train staff, run an internal audit and management review, and then complete the Stage 1 and Stage 2 certification audits.
Read the guideHow to perform a compliance gap assessment (with readiness checklist)
A compliance gap assessment compares your current policies, controls and evidence against the requirements of a standard or regulation, rates each gap by risk, and produces a prioritised remediation roadmap. It is the first step of compliance implementation for ISO 27001, SOC 2, PCI DSS, HIPAA, GDPR or NIST.
Read the guideSOC 2 readiness checklist: Type 1 vs Type 2 and how to prepare
SOC 2 is an AICPA attestation that reports on a service organisation’s controls against the Trust Services Criteria — Security, plus optionally Availability, Processing Integrity, Confidentiality and Privacy. A Type 1 report assesses control design at a point in time; a Type 2 report tests operating effectiveness over a period, typically three to twelve months.
Read the guideAudit & GRC
What is GRC? Governance, risk and compliance explained
GRC stands for governance, risk and compliance: a coordinated approach in which governance sets direction and accountability, risk management identifies and treats the risks that threaten objectives, and compliance ensures the organisation meets laws, regulations, standards and contracts. In cybersecurity, GRC turns security into a managed, measurable business function.
Read the guideInternal audit vs external audit: how to perform an internal security audit
An internal audit is commissioned by the organisation to independently check its own controls and prepare for certification; an external audit is performed by a certification body or independent auditor who issues a certificate or attestation. Internal audits find and fix problems early and are mandatory for ISO 27001 under clause 9.2.
Read the guideWhat is a cybersecurity risk assessment? Process and examples
A cybersecurity risk assessment identifies your important information assets, the threats and vulnerabilities that affect them, and the likelihood and business impact of each risk. The result is a ranked risk register and treatment plan that tells you which security controls to prioritise.
Read the guideRed Team
Why security testing matters in 2026
US$4.44M
global average cost of a data breach in 2025.
241 days
mean time to identify and contain a breach in 2025.
20%
of breaches began with exploitation of a vulnerability, up 34% in a year.
30%
of breaches involved a third party, double the previous year.
44%
of breaches involved ransomware, up 37% year on year.
Let’s find the gaps before someone else does.
Tell us what you need tested for a fixed-scope quote, or talk it through with an Aesparrow practitioner — no obligation, no sales script.