Authorization comes first
Before any testing, confirm who owns the target, which domains/apps/APIs are in scope, test windows, restricted actions and emergency contacts. This is both a safety and delivery-quality control.
How to Choose a Cybersecurity & VAPT Company in India
Security testing should increase clarity, not create a new risk. A professional VAPT engagement starts with written authorization and scope, produces reproducible evidence, protects client data and ends with remediation guidance and a clear retest state.
Discuss your requirementSee engineering proofEvidence should be useful to engineers
A finding needs the affected component, impact, evidence, reproduction context, remediation guidance and status. A vulnerability count without context is not a useful deliverable.
What to evaluate
Scope discipline
The provider should respect written boundaries and stop conditions. Avoid teams that treat “hacking” as an unrestricted activity.
Methodology
Ask how automated scanning is combined with manual review, business-logic testing and API/authentication checks appropriate to the target.
Data handling
Clarify how screenshots, logs, credentials and exported evidence are stored, shared and removed after the engagement.
Severity and prioritization
Findings should be prioritized by real impact and exploitability in your environment, not only a scanner’s generic score.
Remediation support
Engineering teams need concrete fixes and the ability to clarify findings during remediation.
Retest
A retest should reference the original finding and show whether the agreed remediation actually changed the result.
What a professional report should contain
Executive summary, scope and dates, methodology, limitations, prioritized findings, evidence, remediation guidance and retest state. If a provider promises that a website will become “unhackable,” treat that as a red flag; security is risk reduction and continuous engineering, not an absolute guarantee.
Common questions
Can a VAPT company guarantee that my website can never be hacked?
No. A responsible provider can reduce risk, find weaknesses and verify remediation, but no credible security team can promise absolute immunity from future attacks.
What is the difference between VAPT and a vulnerability scan?
A scan is usually automated discovery. A VAPT engagement can add manual validation, business-logic review, evidence, risk analysis and remediation/retest work within an authorized scope.
Should I share production credentials?
Only when the agreed test requires them, through an approved secure channel, with least privilege and a plan to rotate or revoke access afterward.