Last reviewed: 20 October 2026
VAPT in Nepal is bought more often than it is scoped. A bank, insurer or fintech in Kathmandu issues a request for "VAPT of our systems," receives proposals that are impossible to compare, and ends up with a report that lists scanner output but says little about real risk. This guide covers how to scope a vulnerability assessment and penetration test, what a good VAPT report contains, and how VAPT differs from a red team engagement.
What VAPT means, and why regulators ask for it
VAPT combines two activities. A vulnerability assessment looks broadly for known weaknesses. A penetration test goes further and tries to exploit them, to show what an attacker could actually do.
Nepal Rastra Bank's Information Technology Guidelines ask banks to "institutionalize processes to regularly assess the security health of the organization and detect and fix the vulnerabilities," and state: "It is recommended to conduct penetration testing of the system periodically."
NRB's Cyber Resilience Guidelines (2023) go further for the institutions they cover. They define the testing scope as including "vulnerability assessments, scenario-based testing, penetration tests and tests using red teams," and expect institutions to "conduct vulnerability assessments on running services, applications, and infrastructure components on a regular basis," and before "deploying or redeploying new or existing services supporting critical functions."
They also include a warning every buyer should read: "passing such a test is not an indication that no flaws exist or that the system adequately satisfies security objectives." A clean report is evidence about what was tested, under the conditions tested. It is not a guarantee.
Scoping: the decision that sets the value of the test
Most disappointing VAPT engagements were scoped badly, not tested badly. Before you ask for proposals, settle these questions.
What is in scope
List every target by name: application URLs, API base paths, mobile app builds, IP ranges, and cloud accounts. "Our systems" is not a scope. For each target, note who owns it and whether a third party hosts or operates it, because you may need that party's written permission before testing.
What kind of test
- External vs internal. Testing from the internet answers a different question from testing inside your network.
- Authenticated vs unauthenticated. Many serious web and API flaws only appear after login. Provide test accounts for each role.
- Black, grey or white box. The more information the testers have (documentation, architecture, source), the more of their time goes into finding real issues rather than mapping the system.
Which standards the test should follow
For web applications and APIs, ask testers which methodology they follow. The OWASP Web Security Testing Guide (WSTG) describes itself as "the premier cybersecurity testing resource for web application developers and security professionals"; its latest stable version is 4.2. The OWASP Application Security Verification Standard (ASVS) "provides a basis for testing web application technical security controls"; its latest stable release is 5.0.0. The OWASP Top 10 is "the reference standard for the most critical web application security risks," and the current release is the OWASP Top 10 2025.
The Top 10 is an awareness list, not a test plan. A test that only "covers the OWASP Top 10" covers a small share of what WSTG and ASVS describe.
Rules of engagement
Agree in writing: testing windows, systems that must not be disrupted, how to handle a critical finding mid-test, who the emergency contacts are, and how test data is handled and deleted. The CRG also asks institutions to "include all critical internal and external stakeholders in penetration testing exercises, as appropriate."
Independence
The CRG says institutions "should ensure that the tests are carried out by independent parties, whether internal or external." A team testing systems it built or runs is not independent of them.
What a good VAPT report contains
A report is the only lasting output of a test. Ask to see a redacted sample before you buy. A useful report has:
| Section | What to look for |
|---|---|
| Executive summary | Plain-language risk statement for management, not a list of tools |
| Scope and method | Exactly what was tested, when, from where, with which accounts, and against which methodology |
| Findings, ranked | Ordered by exploitability and business impact, not by scanner severity alone |
| Evidence per finding | Request/response, screenshots or steps that let your team reproduce the issue |
| Impact per finding | What an attacker could do with it in your environment |
| Remediation per finding | Specific fixes your engineers can act on |
| Limitations | What was out of scope or could not be tested, and why |
| Retest results | Which findings were verified fixed |
The CRG expects institutions to run a vulnerability management process that can "classify, prioritize, and resolve potential vulnerabilities identified in vulnerability assessments, as well as perform subsequent validation to determine whether gaps have been addressed sufficiently." A report that cannot feed that process, because it lacks clear priorities or reproduction steps, has limited value.
What drives effort and cost
We don't quote prices in an article. These are the factors that change effort:
- the number and size of applications, APIs and mobile builds
- the number of user roles that need authenticated testing
- network size and the number of locations
- whether source code or architecture documents are provided
- testing windows and change-freeze constraints
- whether a retest is required, and how many findings it must cover
VAPT vs red team
The two are often confused, and buying the wrong one wastes money.
VAPT is broad and system-focused. It aims to find as many weaknesses as possible in a defined set of targets, within a fixed window.
Red team testing is objective-focused. NRB's CRG defines it as "a controlled attempt to compromise the cyber resilience of an entity by simulating the tactics, techniques and procedures of real-life threat actors." It adds that "red teams test potential vulnerabilities as well as the effectiveness of an LI's mitigating controls, which include people, processes, and technology," and that a red team "views the cyber resilience of an LI from an adversary's perspective."
The CRG asks institutions to "conduct red team exercises based on specific and plausible threat scenarios, using reliable and valuable CTI" (cyber threat intelligence), and notes that a red team "can be made up of LI employees as well as outside experts who are, in either case, independent of the function being tested."
Decision table
| Your question | Better fit |
|---|---|
| Are there exploitable flaws in this application or network? | VAPT |
| Are we ready to launch a new service or integration? | VAPT before go-live |
| Would our detection and response stop a realistic attacker? | Red team |
| Do our people and processes hold up, not only our technology? | Red team |
| Is this our first security test? | VAPT first; red team once basics are fixed |
Frequently asked questions
Does NRB require penetration testing?
NRB's IT Guidelines state that "it is recommended to conduct penetration testing of the system periodically." For institutions licensed by the Payment Systems Department, the Cyber Resilience Guidelines include penetration tests and red team tests in the expected testing scope.
How often should we run VAPT?
The CRG expects vulnerability assessments "on a regular basis" and before deploying new or changed services supporting critical functions. The right cadence follows from your risk assessment and change rate.
Does a clean VAPT report mean we are secure?
No. The CRG states that "passing such a test is not an indication that no flaws exist." It shows what was found within the agreed scope and time.
Which standards should a web application test follow?
Ask for a named methodology. OWASP WSTG (latest stable 4.2) and OWASP ASVS (5.0.0) are the common references for web applications. The OWASP Top 10 (2025) is an awareness list, not a complete test plan.
When should we move from VAPT to a red team?
When your main question shifts from "what is broken in this system" to "would we detect and stop a real attacker." Fix the basics that VAPT finds first.
Next step
Trinity Technology runs vulnerability assessment and penetration testing across web applications, APIs, mobile apps and network perimeters, and adversary-simulation engagements for organizations that are ready for them. See our VAPT service and offensive security and red team service, or send us your targets and we will reply within 24 hours.