The engagement
What a VAPT engagement covers
A vulnerability assessment enumerates what is exposed. A penetration test establishes what somebody could do with it. Most Indian regulators ask for both, and most buyers are quoted for them together without being told where one stops.
This page sets out the engagement types, the effort each one takes, and what arrives at the end. The work is delivered by Trixent Security, specializing in offensive security assessments and penetration testing.
What can be tested, and what it takes
Tester-days represent the estimated working effort required for an assessment, while calendar duration reflects scheduling and delivery time. The effort depends on the assets in scope, system complexity, available access and documentation, testing constraints, and the depth of validation agreed for the engagement. Parallel work and access dependencies can affect the delivery schedule. Trixent confirms the expected effort and delivery window after reviewing the proposed scope.
| Engagement | What the band assumes | Tester-days |
|---|---|---|
| Web application | One application, authenticated, two to three roles, moderate distinct functionality | 8 to 15 |
| Mobile application | One platform, plus its backing API. Both platforms is not double, because the backend is shared | 8 to 14 |
| External network | Perimeter, up to roughly fifty distinct live hosts | 5 to 10 |
| Internal network | One site or segment, assumed-breach starting position | 8 to 15 |
| API | Documented, one authorisation model. Undocumented adds discovery | 5 to 12 |
| Cloud configuration review | One account or subscription, against a recognised benchmark | 5 to 10 |
| Secure code review | Targeted at security-relevant components, not the whole tree | 8 to 20 |
| Red team | Objective-based, multi-vector, several weeks of elapsed time | 25 to 60 |
Reporting sits inside these bands. A proposal that itemises it separately is being open about something usually buried.
What your assessment should deliver
- Evidence-backed findings. Each finding describes the affected asset, the observed conditions and supporting evidence, with reproduction steps where appropriate and subject to the agreed scope.
- Risk explained in context. Findings include a reasoned severity assessment informed by the technical evidence and the environment. Severity scores can aid prioritization, but they do not replace context.
- Practical remediation guidance. Recommendations focus on addressing the underlying weakness and, where a complete fix requires further work, identifying reasonable interim measures when appropriate.
- Retesting when agreed. Where retesting is included in the engagement, reassess the specified remediated findings and document whether each issue appears resolved, partially resolved or remains open.
How findings are checked
We check that the evidence supports the reported issue, that the affected asset and observed conditions are clear, and that the stated impact and severity rationale are consistent with the available evidence. When scope, access or safety constraints prevent full validation, the limitation is documented rather than presenting an assumption as a confirmed finding.
Start with the scope
Work out the effort first and bring the number to the conversation. It takes about two minutes and it runs in your browser.