VAPT - Vulnerability Assessment & Penetration Testing (Requirements, Scope & Deliverables)

Cybersecurity threats and attacks are a real-world problem today with thousands of organizational networks and web facing applications being compromised daily. Attackers exploit loopholes existing in IT infrastructures as well as poorly coded/implemented application solutions to conduct attacks leading to denial of service (DoS), data theft, identity theft, financial frauds, etc. This make it imperative to constantly assess the state of security of organizations’ network environment, associated IT infrastructures and internet facing applications for assurance on their security for business. Some of the reasons we see for carrying out Vulnerability Assessment & Penetration Testing (VAPT) are not limited to the following:


1. Customer needs:

It is becoming common practice today for customers to request Security Certifications (e.g. PCIDSS, ISO 27001) from their partners or vendors for continued business relationships. This often provide clients with the comfort that their business information as well as personal identifiable information (PIDs) of their customers e.g. names, address, cardholder information and financial details, are safe and will be treated in confidence in the course of that business relationship. It is important to note that security certifications such as PCIDSS and ISO 27001 mandates the conduct of vulnerability assessment and penetration testing at least annually or when significant changes occur in the control environment as a requirement for certification.

2. Compliance:

A good number of industries that serve the public, most importantly those that collect, process and store personal identifiable information such as in banking, insurance, pension, telecommunications, real estate, investment and trusteeship, among others are required by their respective regulators and local laws to have Vulnerability Assessment & Penetration Testing (VAPT) included as a mandatory requirement for players. As such, it is a matter of public safety and security to ensure that these assessments are conducted to assure of compliance of players to laid down rules, procedures and best practices in cybersecurity.

3. Security validation:

Beyond the need for compliance and relationship with customers, vulnerability assessment & penetration testing (VAPT) also helps to validate an organization’s internal security practices, controls and measures against real-world attacks. It helps to demonstrate management commitment to information & cybersecurity by testing the effectiveness and adequacy of cybersecurity governance structures, risk management, strategies, operations and controls. This will help management validate their preparedness for attacks and robustness of strategies to respond to same when they occur.


4. Best-practice & data security:

As threats evolve and attackers adopt new techniques, there is growing need for organizations to carry out proactive security assessments/audits to protect their data and systems from emerging and advanced persistent threats. This is about entrenching the culture and practice of always being ahead of the par, constantly evaluating the control environment for possible loopholes, vulnerabilities, lapses that can be exploited by threat actors/agents to inflict harm on an organization.


Determining the Scope of a Vulnerability Assessment & Penetration Testing (VAPT)

The scope for the VAPT is usually depended on needs of the customer involved, the nature of its business, the industry where it operates and compliance standards within such industry. To be able to perform value adding VAPT, it is important to first gain understanding of the customer business and industry of operation. Doing so will enable one to identify some of the risk prevalent in the customers’ space for proper dimensioning as well as solution to mitigating them. The need for compliance with extant rules and regulations will also help in determining systems, operations and services that will naturally fall in scope of the assessment when considered from risk standpoint. Understanding the customer operating environment will help in determining the scope of the VAPT well enough to be able to provide assurance on the security of the organization operating environment. In general terms, the following will usually be in scope of vulnerability assessment except otherwise stated:

  • i. All devices (hardware or software) with an IP address including PCs, PDAs, servers, network devices, IoT devices, cloud infrastructures will generally be in scope of a vulnerability assessment activity. Vulnerability assessment seeks to scan target devices or systems’ security state against known/defined database of vulnerabilities to determine security loopholes that are associated with such systems for which fixes are already available. This may or may not include zero-day related vulberabilities, for which fixes may not be immediately available. Vulnerability Assessment will usually focus on organization’s internal IT infrastructure (for example, servers, databases, switches, routers, endpoints/workstations, wireless controllers & access points, VPNs, etc.), which can be exploited by an attacker.
  • ii. Penetration Testing usually focus on organization's external parameters, which are, loopholes that could aid access or breach of an organization's perimeter network or sensitive information through external invasive means. Perimeter firewall, extranet segment (i.e. connection with third parties) as well as web facing application servers in the Demilitarized Zone (DMZ) will generally be in scope. This will not exclude servers that are in the campus LAN or data centre segment if there are loopholes that could facilitate their exploitation

Vulnerability Assessment & Penetration Testing (VAPT) Deliverables

The following are the VAPT deliverables:
  • a. Executive Report:

    A high level overview of the activity conducted, summary of issues identified, risk ratings and action items.
  • b. Technical Report:

    A detailed report explaining each issue identified, step-by-step proof of concepts (POCs) for each issue, code and configuration examples to fix the issue and reference links for further details.
  • c. Issue Tracking Dashboards:

    A dashboard that allows client’s team to monitor the audit progress, take immediate actions for high risk issues, track fixes and closure status, etc.
  • d. Repository of Supporting Artifacts.

  For most VAPT, certain level of access to the client’s systems will be required where necessary and all such access are to be closely monitored by client’s team for transparency. To protect the client organization from risk of unauthorized disclosure of information, a Non-disclosure agreement (NDA) is usually executed between the client and the provider of the service as generally required to ensure protection of client organization's confidential and internally used information that will be in the custody of the service provider during and after the engagement period.

Nwabueze Ohia

(Cybersecurity consultant, Tech Blogger & Author)

Will appreciate your questions and contributions on to post. For sponsorship, ad placement, speaking opportunity and training bookings, please Contact US or Send us an email at

Back To Information and Cyber Security Jobs

Learn More About Our Valuable IT Audit Programs/Checklists

Learn More About Our Valuable Risk Assessment &Templates & Checklist

Learn More About Leading Practices in Internal Audit Function

Popular Articles

Investing in Information Technology is pivotal to the success of a business and realization of enterprise goals/objectives. To create value for the business using IT.Learn More
Fintech applications such as Online Banking has disrupted the traditional "brick and mortar" banking that we all have been accustomed to over the years. Online Banking application brought about easyLearn More
Protecting Automated Teller Machine (ATM) network end-to-end requires layered approach to security (implementing security at ATM endpoints, physical and logical network)Learn More
Audit management software are used to automate the process of auditing. Most standardized audit management software come handy with good audit process automation....Learn More
The 21st century as the information/digital age has presented numerous challenges and opportunities for humanity. From widespread industrial revolution to notable advances in IT.Learn More
The Central Bank of Nigeria (CBN) recently issued a revised circular on the regulatory framework for Unstructured Supplementary Service Data (USSD) for financialLearn More
The series attempted to answer most of the governance and management questions/concerns and how IT Governance and Management Questions are mapped to COBIT 5 Enterprise GoalsLearn More
Cloud computing is the practice of using network of remote computing infrastructures hosted on the Internet to store, manage, and process data for end users....Learn More
Remote access software are tools used to access or take full control of computing systems from a remote location either to provide support, access files...Learn More
Mobile hacking is an exciting field for cybersecurity enthusiast and at the same time lucrative for hackers. This is given significant rise in the number of mobileLearn More

IT Audit, IT Risk and Cyber Security eBooks By Nwabueze Ohia

Auditing Your Information Systems and IT infrastructure: Practical Audit Programs/Checklists for Internal AuditorsGet Now
IT Infrastructure Risk & Vulnerability Library: A Consolidated Register of Operational & Technology Infrastructure Vulnerabilities for IT Assurance ProfessionalsGet Now
Auditing Your Payment Cards Processes, Systems and Applications: A Step By Step PCIDSS Compliance Audit Program For Brands, Issuers, Acquirers, ProcessorsGet Now
Auditing Your Windows Infrastructure, Intranet And Internet Security: A Practical Audit Program for Assurance ProfessionalsGet Now


Let us know your thoughts post. Leave a Comment below.