VAPT stands for vulnerability assessment and penetration testing. In plain terms, it's an authorised check of your website, apps, servers or office network, done by people who look for weaknesses the way an attacker would, so you can fix them first.
It's often asked for by larger clients, partners or auditors, but it's just as useful for a growing business that wants to know where it stands.
The two parts
Vulnerability assessment is a broad scan. Tools and testers check your systems for known weaknesses: outdated software, missing security updates, weak settings, exposed admin pages and certificates that are about to expire. It answers the question "what could be wrong?"
Penetration testing goes deeper. Testers safely try to use the weaknesses they found, for example to see whether a login can be bypassed or whether one customer can see another customer's data. It answers the question "what could someone actually do with it?"
What can be tested
- Websites and web apps: logins, forms, payment pages, admin areas and how data is handled.
- Mobile apps and the systems behind them.
- Servers and cloud accounts: open ports, settings, updates and access rights.
- Office networks: firewalls, Wi-Fi, VPNs, and separation between guest and staff networks.
Is it safe for my live website?
Done properly, yes. A good test starts with written permission and a clear scope: what will be tested, when, and what is out of bounds. Heavier tests are scheduled at quiet times, and anything risky is agreed in advance or run on a copy of the system.
What you get
The result is a report that lists each finding with a risk rating, evidence of what was found and a clear fix. A good report has a short summary for owners and managers, and technical detail for whoever makes the changes. Once the fixes are done, a re-test confirms they worked.
How often should you test?
At least once a year, and after any major change: a new website, a new app release, a move to a new server or cloud, or a new office network. Between tests, regular updates, monitoring and a monthly scan keep the basics in place.
How to prepare
- Decide which systems matter most, such as the website that takes payments or the server that holds customer data.
- Make sure you have permission from any hosting or software provider whose systems are involved.
- Take a fresh backup before testing starts.
- Name one person who can answer questions and approve fixes.
Where to start
If you've never had any security review, start smaller. Our free security health check is a non-intrusive look at your website, email and online set-up, with your top risks in a short report. When you're ready for a full test, our cyber security team runs VAPT for websites, apps, servers and networks, with a re-test after the fixes. Launching a new site? Our website launch checklist covers security basics too.