Skip to content

ISO 27001, SOC 2, the DPDP Act and manual VAPT. Book a Free Scoping Call

Help centre

What Information Do You Need for a VAPT Proposal?

To quote a fixed price, SecureRoot needs to know what is in scope and how big it is: which surfaces you want tested, their size in roles, endpoints, platforms or hosts, the environment we would test, and why you are testing. You do not need to send credentials or data to get a proposal. With this information, one scoping call of 30 to 45 minutes is usually enough to agree a written scope and a fixed price, with the retest included.

Request an assessmentContact us

About this help article

Written by SecureRoot Risk Advisory LLP.

Start here

Tell us why you are testing

The reason decides the scope, the timing and the kind of report you need.

  • What started it: a customer security questionnaire, an auditor's request, a regulator's rule, a new release or an incident.
  • The deadline, and whether the report goes to an auditor, a customer or your board.
  • The framework the test supports, if any, such as SOC 2, ISO/IEC 27001 or PCI DSS.
  • Whether a rule or tender says who must sign the report. SecureRoot is not CERT-In empanelled, not a QSA and not a CPA firm. If one of those must sign, tell us early and we will say what we can and cannot do.

Scope

Describe each surface and its size

Price is driven by the size of each surface, not by page count. Send what applies.

  1. 01

    Web application

    The URLs, the environment they run in, and the number of user roles. Mention approval chains, tenant boundaries and admin consoles, because access-control testing needs accounts on both sides of each.

  2. 02

    API

    A definition of the API: an OpenAPI or GraphQL schema, a Postman collection or captured client traffic. Out-of-date documentation is normal and not a blocker. Say how many endpoints, tenants and authentication schemes there are.

  3. 03

    Mobile application

    Android, iOS or both, the backend endpoints the app calls, and anything that blocks installation on a test device, such as device attestation, an MDM wrapper or an enterprise distribution profile. Source code is optional.

  4. 04

    Network

    External: the address ranges and hostnames you own, and who can authorise testing them. Internal: the segments in scope, the systems excluded and how a tester would get a foothold, such as a VPN account or a jump host.

  5. 05

    Cloud

    The providers and the number of accounts, subscriptions or projects, and how they sit behind your identity provider.

  6. 06

    Thick client

    The application versions and installers in scope, the backend services they talk to, and the roles the application distinguishes.

Environment

Say where testing would happen

  • Staging or production. SecureRoot prefers staging when it mirrors production in code, configuration and roles. If it does not, say what differs.
  • Who hosts it, and any third-party services in the path that you do not control.
  • Testing windows that suit your change calendar, and any actions or data that are off limits.
  • A named technical contact who can answer questions while testing runs.

SecureRoot has offices in India only and delivers internet-facing testing remotely. Raise any need for on-site work at this stage, so it can be scoped before a price is given.

Keep back

What not to send yet

  • Passwords, API keys or tokens. Test accounts are created after the scope is agreed, and the Rules of Engagement are signed before testing starts.
  • Production data or real customer records. They are not needed to scope, or to test.
  • Full source code, unless a secure code review is part of the request.

Next

What you get back

After the scoping call SecureRoot sends a written scope, a timeline and a fixed price held against that scope. If the scope grows, the difference is re-quoted rather than invoiced as a surprise.

For a web application, mobile application, API or network, the published band is ₹50,000 to ₹4 lakh per surface, with the retest included. Where you land depends on the size of the surface. Cloud, thick client and IoT testing are quoted with the scope. See the pricing page for what each band includes.

Scope boundaries

What this does not cover

  • A proposal is not an authorisation to test. Testing starts only after a signed Rules of Engagement.
  • SecureRoot cannot sign a report that a rule or tender reserves for a CERT-In empanelled auditor, a QSA or a CPA firm.
  • You remain responsible for confirming that you own, or are authorised to have tested, every target you list, including third-party hosted services.

Primary Sources

Where the Figures on This Page Come From

Every deadline, threshold and control count above is taken from the instrument itself. These are links to the primary text, not to a summary of it.

Related

Services and help that go with this

Send us your scope

Tell us what you run and why you are testing. We will come back with a scoping call, then a written scope and a fixed price.

Request an assessmentContact us