VAPT testing — Vulnerability Assessment and Penetration Testing — combines two distinct security activities into a single coordinated engagement. It’s the most common form of security testing UK businesses commission, and it satisfies the testing requirements of nearly every major compliance framework: PCI DSS, ISO 27001, SOC 2, Cyber Essentials Plus, and FCA cybersecurity expectations.
This guide explains what VAPT testing is, what it covers, what to look for in a UK provider, and how it differs from other forms of security testing.
What Is VAPT Testing?
VAPT testing combines two activities that are often confused:
Vulnerability Assessment (VA)
A breadth-first scan of systems for known vulnerabilities — missing patches, default credentials, misconfigurations, and outdated software. Vulnerability assessment uses both automated scanners and manual verification. The goal is comprehensive coverage: identifying every known issue, even low-severity ones.
Penetration Testing (PT)
A depth-first attempt to exploit identified vulnerabilities, demonstrate impact, and find issues that automated scanning misses — particularly business logic flaws, chained vulnerabilities, and authorisation issues. Penetration testing requires manual work by experienced engineers and produces fewer but more impactful findings.
Why Combine Them?
Vulnerability assessment alone gives you a long list of findings, but doesn’t tell you which ones an attacker would actually exploit. Penetration testing alone may miss patching gaps that don’t affect the specific attack paths the engineer pursues. VAPT testing combines both to give you comprehensive coverage plus exploitation-validated impact assessment — which is what most compliance frameworks actually require.
VAPT Testing: What’s Included
A typical VAPT engagement covers:
Vulnerability Assessment Phase
- Authenticated and unauthenticated automated vulnerability scanning
- Configuration assessment against industry baselines (CIS Benchmarks, Microsoft Security Baselines)
- Patch management gap analysis
- Default credential and weak password discovery
- Service enumeration and outdated software identification
- SSL/TLS configuration review
- Manual verification of scanner findings (eliminate false positives)
Penetration Testing Phase
- Manual exploitation of identified vulnerabilities
- Privilege escalation attempts on compromised hosts
- Lateral movement across network segments (where in scope)
- Business logic vulnerability discovery (authorisation issues, IDOR, race conditions)
- Chained vulnerability exploitation (combining multiple low-severity issues into high-impact attack paths)
- Custom payload development where required
- Evidence collection and impact validation
