Vulnerability assessment and penetration testing (VAPT)
Systematic vulnerability assessment and penetration testing across web applications, APIs, mobile apps, and network perimeters. Findings are prioritised by exploitability and business impact, with clear remediation guidance for engineering teams.
VAPT is scoped, time-bound testing against defined targets. If you need multi-phase adversary simulation across people, process, and technology, see Offensive Security & Red Team Engagements.
Who this is for
Methodology
Scoping
Define in-scope assets, testing boundaries, rules of engagement, and success criteria with your technical and business owners.
Assessment
Vulnerability scanning and manual penetration testing across agreed targets — web, API, mobile, or network — using OWASP-aligned methods.
Findings
Document each finding with reproducible steps, evidence, severity rating, and practical remediation guidance for your engineering team.
Retest
Retest remediated findings and issue confirmation of closure — or document residual risk where fixes are deferred.
What you get
- Technical penetration test report with step-by-step reproduction evidence
- Executive summary for leadership and audit stakeholders
- Findings register with severity ratings and remediation recommendations
- Screenshots, request/response logs, and proof-of-concept artefacts as applicable
- Retest confirmation report after remediation
Engagement FAQ
A fixed fee based on the agreed scope, quoted after a scoping call.
Typically 1–3 weeks per application, depending on scope.
Yes. One retest of reported findings is included, within 30 days of report delivery.
We test only the environments you approve at scoping, within the testing boundaries and rules of engagement agreed with your technical and business owners.
Typically test accounts for each role in scope, whitelisting of our source IP addresses where you filter traffic, and an agreed test window. We confirm the exact list at scoping.
Yes. We sign a mutual NDA before scoping. We can sign yours or provide ours.
We store client data and evidence in Microsoft 365, encrypted at rest (AES-256), with access limited to the engagement team. We delete them 90 days after the engagement closes and confirm the deletion in writing.
Every engagement is led by one of our three co-founders, from scoping through remediation. VAPT is led by our Head of Offensive Security.
The full list of deliverables is under What you get above.
Or email contact@trinitytech.com.np