VAPT and penetration testing are not the same thing. A penetration test is one half of a VAPT: the half that proves what an attacker can actually do.

Quick answer: penetration testing is a manual, simulated attack that proves how far a real attacker could get. VAPT (Vulnerability Assessment and Penetration Testing) combines two things: a broad vulnerability assessment that finds as many weaknesses as possible, and a penetration test that exploits the important ones to prove their real business impact. In short, VA gives breadth, PT gives depth and VAPT gives both.

VAPT vs penetration testing comparison: vulnerability assessment covers breadth, a penetration test covers depth, and VAPT combines both

"We need a VAPT" and "we need a pentest" are often used as if they mean the same thing. Regulators, auditors and vendors don't always use the terms the same way either. This confusion causes real problems. Companies buy a scan when they needed a pentest, or pay for a full VAPT when a focused test would have done. This guide explains what each term means, how they differ and when you need which one. It also covers how to make sure you get what you pay for.

What is a vulnerability assessment (VA)?

A vulnerability assessment is a systematic review that identifies, classifies and prioritises known security weaknesses across your systems. It answers one question: "What weaknesses do we have?"

It usually combines automated scanners such as Nessus, Qualys, OpenVAS or Burp Suite with manual validation to remove false positives. Typical findings include missing patches, outdated software, weak SSL/TLS settings, default credentials, open ports and misconfigurations.

A VA covers a lot of ground quickly. However, it does not exploit anything, so it cannot tell you what an attacker could actually achieve.

What is penetration testing (PT)?

Penetration testing is an authorised, simulated cyberattack carried out mainly by skilled human testers. It answers a different question: "What could an attacker actually do to us?"

Testers try to exploit weaknesses and chain small issues together. They then show the real impact, such as taking over an admin account, reading another customer's data or moving from a web server into the internal network. A pentest also finds flaws that scanners cannot see, including broken access control, business-logic abuse, payment manipulation and authentication bypass. Read more in from vulnerability to exploitation: what a real pentest reveals.

What is VAPT?

VAPT stands for Vulnerability Assessment and Penetration Testing. It is a combined engagement in two stages:

  1. VA stage: scan and review the full scope to map every weakness.
  2. PT stage: manually exploit the most important weaknesses, and test logic the scanners cannot reach, to prove real-world risk.

The result is a single report that is both broad (nothing obvious is missed) and deep (critical risks are proven, not guessed). VAPT is the term most often used in Bangladesh, India, the Middle East and in banking regulations. Penetration testing, or pentest, is more common in the US and Europe.

InfographicBreadth vs depth: what each engagement coversEach column is an asset in scope; each row is a level of depth, from surface weaknesses at the top to proven, chained attack paths at the bottom.
Vulnerability assessmentBreadth. Every asset, surface depth. Answers "what weaknesses exist?"
Penetration testDepth. Chosen assets, tested down to proven impact. Answers "what can an attacker do?"
VAPTBoth. Every asset assessed, critical paths exploited. Answers "what exists, and what is truly exploitable?"

VAPT vs penetration testing vs vulnerability assessment: how do they compare?

The main difference is depth versus breadth. VA finds weaknesses, PT proves their impact, and VAPT does both in one engagement.

AspectVulnerability Assessment (VA)Penetration Testing (PT)VAPT
Core questionWhat weaknesses exist?What can an attacker actually do?What exists, and what is truly exploitable?
ApproachMostly automated, with manual validationMostly manual, attacker mindsetAutomated breadth plus manual depth
ExploitationNoYes, safely and with permissionYes, for prioritised findings
CoverageBroad: whole network or many assetsFocused: chosen apps or attack pathsBroad and focused
Finds business-logic flawsRarelyYesYes
False positivesSome, unless validatedVery few, since issues are provenVery few
Skill requiredModerateHigh (OSCP, OSWE, CREST level)High
Typical duration1 to 5 days1 to 4 weeks2 to 6 weeks
Relative costLowMedium to highHighest of the three, but best value for compliance
OutputList of vulnerabilities with severityAttack narratives, proof of concept, business impactFull risk picture with prioritised fixes
Best frequencyMonthly or quarterlyYearly and after major changesYearly, or as the regulator requires

For typical BDT price ranges for each, see our Penetration Testing Cost in Bangladesh (2026 Pricing Guide).

How does a VAPT engagement work?

A professional VAPT follows eight stages, from scoping to re-test. Knowing them helps you check whether a vendor is doing the full job.

  1. Scoping and rules of engagement. Agree on targets, testing windows, test accounts, excluded systems and emergency contacts. Sign the NDA and written authorisation.
  2. Reconnaissance. Map the attack surface: domains, subdomains, IPs, APIs, app features and technologies.
  3. Vulnerability assessment. Run authenticated and unauthenticated scans, then manually validate the results to remove false positives.
  4. Manual penetration testing. Test authentication, authorisation, business logic, input handling, APIs and configuration. Follow standards such as OWASP WSTG, OWASP MASVS, the OWASP API Security Top 10, PTES or NIST SP 800-115.
  5. Exploitation and impact proof. Safely exploit confirmed issues and chain them together to show what an attacker could really reach.
  6. Reporting. Deliver an executive summary, risk-rated findings (for example CVSS), proof of concept, business impact and clear fixes.
  7. Remediation support. Walk your developers and IT team through the findings and answer their questions.
  8. Re-testing. Verify that each fix works, then issue a final or re-test report for auditors and management.

If a quote skips stages 4, 5 or 8, you are most likely buying a vulnerability assessment, not a VAPT. For a closer look at a live engagement, read what happens during a professional penetration test.

Which one does your business need?

Choose based on your goal, not the label. Use this guide to match your situation to the right service.

Your situationBest fitWhy
Regular security hygiene between major testsVulnerability assessment (monthly or quarterly)Catches new CVEs and missing patches quickly and at low cost
Launching a new web or mobile app, or a major releasePenetration testProves that logic, access control and payment flows can't be abused before customers use them
Bank, NBFI, MFS, PSP or other Bangladesh Bank-regulated entityVAPTRegulators and auditors expect both broad coverage and proven risk
PCI DSS, ISO 27001 or SOC 2 audit coming upVAPT, or a pentest plus scansAuditors need evidence of vulnerability management and security testing
Enterprise customer or tender asks for a security reportPenetration test or VAPT, as the buyer specifiesA third-party report builds buyer trust and wins contracts
Large internal network with hundreds of hostsVAPTVA maps the whole estate, PT tests the paths to critical systems
AI chatbot, LLM or agent-based applicationPenetration test (AI/LLM focused)Prompt injection and data leakage are logic flaws that scanners miss
After a security incidentPenetration test of the affected area, then VAPTConfirms the hole is closed and finds other ways in

Rule of thumb: use VA to stay clean, PT to prove you are safe, and VAPT when someone else needs to see proof of both.

What are the most common myths about VAPT and pentesting?

Myth 1: "A scanner report is a VAPT." A scanner covers only the VA half. Without manual exploitation there is no "PT", so the most damaging flaws stay hidden. See why automated security scanning isn't enough.

Myth 2: "More findings means a better test." A 300-page report full of low-risk and duplicate items is less useful than 12 proven, prioritised findings with clear fixes. Judge a test by quality, not volume.

Myth 3: "We passed the pentest, so we are secure." A pentest is a snapshot of one scope at one point in time. New code, new staff and new CVEs change your risk every month.

Myth 4: "Pentesting will crash our systems." Professional testers agree rules of engagement first and avoid destructive actions without approval. Testing in a production-like staging environment reduces the risk further.

Myth 5: "VAPT is only for banks." Any business that holds customer data, takes online payments or sells to enterprise clients is a target. E-commerce, SaaS, telecom, healthcare, education and RMG platforms all benefit.

Why does the difference matter in Bangladesh?

In Bangladesh, "VAPT" is the term regulators, banks and tender documents use most. Buying the wrong service can mean a failed audit or a rejected bid.

  • Bangladesh Bank. The Guideline on ICT Security applies to banks, NBFIs, MFS providers, PSPs and PSOs, and requires half-yearly internal scans plus penetration testing at least once a year (see Bangladesh Bank VAPT requirements). The new Cybersecurity Framework v1.0 (2026) must be implemented by 31 December 2026.
  • Cyber Security Act 2026. Passed by Parliament on 10 April 2026, it raises expectations for operators of critical information infrastructure.
  • Personal data protection. Bangladesh's personal data protection law requires organisations to keep personal data secure. Regular testing is strong evidence of reasonable security.
  • Tenders and enterprise buyers. Banks, telcos and government bodies increasingly ask suppliers for a recent third-party VAPT or pentest report.

When a regulator or tender asks for "VAPT", make sure your vendor delivers both halves. That means a full-scope assessment and manual exploitation, with a re-test report as proof of remediation.

Frequently asked questions

Is VAPT the same as penetration testing?

No. Penetration testing is one part of VAPT. VAPT adds a broad vulnerability assessment before the pentest, so it covers both breadth and depth.

What is the full form of VAPT?

VAPT stands for Vulnerability Assessment and Penetration Testing.

Which is better, VA or PT?

Neither is better on its own. They do different jobs. VA is best for frequent, broad checks. PT is best for proving real risk in critical systems. Most organisations need both, which is why VAPT exists.

Is a vulnerability scan the same as a vulnerability assessment?

Not exactly. A scan is the automated part. A vulnerability assessment adds manual validation, prioritisation and remediation advice on top of the scan results.

How often should VAPT be done?

At least once a year, and after major releases, infrastructure changes or a security incident. Running vulnerability scans monthly or quarterly between full VAPTs is good practice.

How long does a VAPT take?

A single web application usually takes 1 to 2 weeks, including reporting. A multi-asset or bank-wide VAPT can take 4 to 12 weeks.

Does VAPT cost more than a pentest?

Usually yes for the same scope, because it covers more ground. Bundling both into one engagement is still cheaper than buying a separate VA and pentest.

Is VAPT mandatory in Bangladesh?

For Bangladesh Bank-regulated institutions, yes: the ICT Security Guideline requires half-yearly internal scans and penetration testing at least once a year. For other businesses, it is often required by customers, tenders and standards such as PCI DSS and ISO 27001.

What should a VAPT report include?

It should include an executive summary, scope and methodology, and risk-rated findings with proof of concept and business impact. It should also give step-by-step fixes and include a re-test confirmation.

The bottom line

Vulnerability assessment shows you what is wrong. Penetration testing proves what an attacker could do with it. VAPT gives you both in one engagement, and that is what regulators and auditors in Bangladesh usually expect. Whatever you buy, ask how much of it is manual testing, who the testers are and whether a re-test is included. Those three answers tell you more than the label on the quote.

Not sure whether you need a VA, a pentest or a full VAPT? PentesterSpace is a Bangladesh-based penetration testing company. We deliver VAPT services in Bangladesh and penetration testing for web and mobile apps, APIs, networks, cloud and AI/LLM applications. Tell us about your systems and your compliance goals, and we will recommend the right scope, with no unnecessary extras.

Sources

All articles