VAPT in Sri Lanka: an honest buyer's guide

What VAPT actually means

VAPT stands for Vulnerability Assessment and Penetration Testing, and it is the same service Western vendors sell as a penetration test. If you are comparing a “VAPT provider” in Colombo against a “pentest firm” in London or Austin, you are comparing the same engagement under two names.

The term dominates procurement language across South Asia. Tenders, vendor questionnaires, and audit checklists in Sri Lanka, India, and Bangladesh ask for VAPT; the equivalent US or UK document asks for penetration testing. Global cost guides, methodologies, and report standards apply to both because they are one market.

The name is actually useful, because it spells out the two halves of the work: the vulnerability assessment (VA) and the penetration test (PT). Understanding the difference between those halves is the single most important thing a buyer in this region can do, because the most common failure mode here is paying for both and receiving one.

The VA half, the PT half, and the regional trap

A vulnerability assessment finds potential weaknesses with automated tools; a penetration test proves which of them are actually exploitable. They are complementary, not interchangeable.

The VA half is breadth: scanners sweep your application for known weaknesses and misconfigurations and produce a list of candidates, false positives included. The PT half is depth: a human being attacks the application, tests authentication and business logic, chains low-severity findings into real intrusion paths, and writes reproduction steps for each confirmed issue. Scanners cannot do the PT half. No scanner will notice that user A can read user B's invoices by changing a number in a URL, or that your discount logic can be replayed.

The regional trap: a meaningful share of “VAPT” sold in this market is a scanner export with a new cover page. That is the VA half sold at PT prices. You can detect it in the deliverable: no reproduction steps, no business-logic findings, no named methodology, and hundreds of informational items padding the page count.

We wrote a full comparison in penetration testing vs vulnerability scanning. The short version: if nobody with hands on a keyboard attacked your app, you did not buy a penetration test.

What VAPT should cost

Published 2026 cost guides from DeepStrike, Blaze Infosec, Intruder, and Astra put a typical web application pentest at roughly $5,000 to $35,000 and up; a quote dramatically below every published range is usually the VA half in disguise.

For reference, our own number sits below those ranges by design: a fixed $2,499 for a web and API engagement, retest included, detailed on the pentest page. The structure that makes it possible (one senior engineer plus heavy scanner automation, Colombo cost base, fixed scope) is covered in our full penetration testing cost guide.

The PDPA angle, honestly

Sri Lanka's Personal Data Protection Act No. 9 of 2022 does not mandate penetration testing. It requires security safeguards and a Data Protection Management Programme; a pentest is how you evidence both, not a line-item legal obligation.

This matters because “PDPA-mandated VAPT” has become a sales line in this market, and it is not what the Act says. The PDPA obliges controllers and processors to implement appropriate security safeguards for personal data and to maintain a Data Protection Management Programme. It does not name penetration testing as a required control.

What a pentest gives you under the PDPA is evidence. If a regulator, a client, or your own board asks how you know your safeguards work, a dated report from an independent tester, with findings, fixes, and a retest, is a concrete answer. “We installed a firewall” is a claim; a pentest report is proof the claim was tested. Buy it for that reason, not because someone told you the law forces you to.

ISO 27001 is the real certification driver

In practice, the document that pushes most Sri Lankan companies into buying a pentest is not the PDPA. It is ISO 27001, because regional enterprise and outsourcing contracts increasingly require the certification.

ISO 27001:2022 control A.8.8 (management of technical vulnerabilities) lists periodic penetration testing among the accepted methods for identifying vulnerabilities, and A.8.29 covers security testing in development and change. Certification auditors routinely ask what your vulnerability-identification method is, and a periodic pentest with a signed report is the cleanest answer available.

If ISO 27001 is what is actually driving your purchase, read our dedicated ISO 27001 penetration testing page for the control-by-control mapping. Companies selling into the US market should note the parallel: SOC 2 also does not explicitly require a pentest, but auditors expect one as monitoring evidence, commonly mapped to CC4.1.

What Sri Lanka CERT|CC actually says

Sri Lanka CERT|CC recommends periodic security assessments, at least annually, and published Web Application Security Guidelines for government organizations in 2022.

Two practical takeaways. First, the at-least-annual cadence is a sensible default for any organization, not just government: an assessment older than a year describes an application that no longer exists. Second, if you sell software or services to Sri Lankan government organizations, the 2022 guidelines define the web application security baseline your buyers are told to hold you to, so testing against it before procurement asks is cheaper than scrambling after.

For the broader picture of what we do locally, see our Sri Lanka page.

10 questions to ask any VAPT provider

These ten questions separate a real VAPT from a scanner run in one phone call. We answer each one for ourselves below, so you can hold us to the same standard.

Red flags

Three patterns account for most bad VAPT purchases in this market: certification mills, scanner-dump reports, and quotes without a retest.

Local vs global providers

A Colombo provider gives you working-hours access and local context; a global firm gives you reach. The practical question is whether you can get both without paying twice.

Ghost Protocol (Pvt) Ltd is registered in Colombo, founded in 2024, and delivers worldwide. For Sri Lankan buyers that means scoping calls in your working day and a counterparty under local law; for overseas buyers it means a Colombo cost base priced in USD. All delivery is in English: the report, the walkthrough call, and the 30-day Q&A. We do not offer Sinhala or Tamil deliverables, and we would rather say that here than let you discover it at delivery.

One scope note that matters when comparing local firms: our engagement covers web applications and APIs only. If you need on-site work (internal network testing, physical assessments), that requires a provider with people in your building, and you should scope it separately. Our full local service breakdown is on the penetration testing in Sri Lanka page.

Before you spend anything: run the free scan

The cheapest first step in any VAPT purchase is free: run the Ghost Scan on your own domain before you talk to any provider, including us.

It checks your public surface across 9 categories in minutes, with no card and no signup. It is not a penetration test and we will never call it one, but it answers the question every buyer should ask first: what does my application look like from the outside right now? If you want more depth without a full engagement, a one-time $499 deep scan runs 75+ scanner modules and delivers an executive PDF in about 48 hours.

When you do need the PT half (an ISO 27001 audit, an enterprise security questionnaire, a launch, a board asking for proof), the fixed-price penetration test is the next rung: one engineer, 75 scanner modules, 5 to 7 days, free retest.

Frequently asked questions