VAPT vs penetration testing: what the terms actually mean.
VAPT, vulnerability assessment, penetration test, pentest. Procurement documents across Southeast Asia use these interchangeably, and they are not the same thing. Here is the distinction, and how to tell which one your requirement describes.
Three terms, two activities.
Vulnerability Assessment
A breadth-first exercise. Authenticated and unauthenticated scanning, configuration review and version analysis across as much of the estate as possible, producing a ranked inventory of weaknesses. It tells you what is probably wrong, across many systems.
Penetration Testing
A depth-first exercise. A consultant exploits weaknesses where it is safe to do so, chains them together, pivots, and demonstrates what an attacker could actually reach. It tells you what is definitely wrong, and what it would cost you.
VAPT
Not a third technique. VAPT is the procurement term for commissioning both in one engagement — the assessment for coverage, the test for proof. Most regulated buyers in the region write their requirements this way.
Where the two differ.
Primary question
What weaknesses exist across the estate?
What can an attacker actually achieve?
Coverage
Broad. Many hosts, applications or accounts.
Focused. A defined scope, examined in depth.
Method
Largely tool-driven, with consultant validation to remove false positives.
Consultant-led, with tooling in support. Manual exploitation and chaining.
Evidence produced
A ranked inventory of findings with severity ratings.
Reproduction steps, captured evidence and a demonstrated impact path.
Typical cadence
Frequent. Often continuous or quarterly.
Periodic. Commonly annual, and after significant change.
What it cannot tell you
Whether a finding is genuinely exploitable in your environment.
Whether the same weakness exists on systems outside the agreed scope.
Which one does your requirement describe?
You need coverage across a large estate
A vulnerability assessment. If the question is "how exposed are we across 400 hosts", depth on three of them does not answer it.
You need to prove real risk to a board or regulator
A penetration test. A ranked scanner output rarely survives the question "but could someone actually do this?"
Your regulator or tender says VAPT
Both, in one engagement. Check the wording for a required frequency and whether retesting after remediation is in scope.
You are testing a single new application before launch
A penetration test. Coverage is not the constraint; the application is the scope.
Common buyer questions.
What does VAPT stand for?
VAPT stands for vulnerability assessment and penetration testing. It is a procurement term for commissioning both activities together rather than a separate testing technique in its own right.
Is VAPT the same as a penetration test?
No. A penetration test is one half of VAPT. The other half is a vulnerability assessment, which covers far more of the estate but stops short of exploitation. A tender that says VAPT is usually asking for both.
Which should a company do first?
Usually the vulnerability assessment, because it establishes where the weaknesses are concentrated and lets the penetration test be scoped against real exposure rather than a guess. Where a single new application is going live, the penetration test alone is often the right answer.
How often is VAPT required?
It depends on the framework. PCI DSS requires penetration testing at least annually and after any significant change, with more frequent segmentation testing for service providers. MAS Technology Risk Management, OJK requirements and Bank of Thailand ICT risk guidance each set their own expectations. Vulnerability assessment is normally run far more frequently than penetration testing.
Test Your Defences Against Adversarial Expertise
Talk to a CREST-registered consultant about your next penetration testing engagement.