VAPT in Pakistan: what a security test should cover, and what to ask before you hire
In short: VAPT is two jobs. A vulnerability assessment finds known weaknesses across everything you own. A penetration test proves which of them an attacker could really use, and how far they would get. A good provider does both, gets your written permission first, and hands you a report your team can act on.
What VAPT means
Vulnerability Assessment (VA) is wide and systematic. Testers map every system you expose (websites, email, VPN, remote desktop, cloud accounts, office network) and check each one for known weaknesses: missing patches, weak settings, default passwords, old software, open services that should be closed.
Penetration Testing (PT) is deep and manual. A tester takes the most promising weaknesses and tries to use them the way a real attacker would: logging in where they should not, moving from one system to the next, reaching data that should be out of reach. The point is to show real impact, not a list of theoretical issues.
A scan alone produces long reports full of noise. A pentest alone can miss whole areas. Together they tell you what is exposed and what actually matters.
What a proper test covers
- External: everything reachable from the internet. Websites and web apps, email servers, VPN, firewalls, remote desktop (RDP), file sharing, forgotten test or staging servers.
- Internal: what an attacker could do once inside, for example after one staff laptop is infected. Shared drives, Active Directory, servers, printers, CCTV and other devices on the same network.
- Web and mobile apps: login, password reset, payment and user-data features, tested against the OWASP Top 10 and your own business logic.
- Cloud and Microsoft 365 / Google Workspace: admin accounts without MFA, public storage buckets, over-shared files, risky mail forwarding rules.
- People (optional): a controlled phishing test to see how many staff click and how many report it.
How a proper engagement runs
- Scoping. Agree exactly which systems, IP addresses and apps are in scope, what is off limits, and the testing window.
- Written authorisation. You sign a document allowing the test. This matters in Pakistan: unauthorised access to an information system is an offence under the Prevention of Electronic Crimes Act (PECA) 2016. A tester who starts without your signed permission is a warning sign.
- Reconnaissance. Testers find what is exposed, often including systems you forgot you had.
- Assessment and exploitation. Automated scanning plus manual testing, carefully, so business systems stay up.
- Reporting. An executive summary in plain language for management, and a technical section with evidence, risk rating and fix steps for each finding.
- Retest. After your team fixes the issues, the tester checks that the fixes work.
10 questions to ask before you hire a tester
- Will you test manually, or only run automated scanners?
- Who exactly will do the testing, and what is their experience or certification (for example OSCP, CEH, CREST)?
- Can I see a sample report with client details removed?
- What written authorisation and NDA will we sign before you start?
- How do you avoid crashing our live systems, and who do we call if something breaks?
- How do you rate risk (critical, high, medium, low), and why?
- Will the report tell my IT team how to fix each issue, step by step?
- Is a retest included after we fix the findings?
- How will you store and delete our data after the engagement?
- Do you use subcontractors? If yes, who, and are they bound by the same NDA?
How often should you test?
At least once a year, and again after any big change: a new website or app, a move to the cloud, a new office network, or a merger. Businesses that handle payments, health or customer financial data, or that supply banks and government, usually test more often because their clients or regulators ask for it.
Red flags
- A report that is just scanner output with your logo on it.
- No scoping call, no written authorisation, no NDA.
- Every finding marked "critical", or none at all.
- No explanation of how to fix things, only what is wrong.
- A price quoted before anyone asks what you want tested.
What you should get at the end
A clear picture of your real exposure, a prioritised list of what to fix first, evidence your management and auditors can trust, and proof (after the retest) that the important gaps are closed. If the report sits in a drawer, the money was wasted, so ask for findings your team can work through in order.
Want a second pair of eyes? FarSec checks businesses in Pakistan for exactly these gaps and helps fix them. Email [email protected] and tell us what worries you.