VAPT stands for Vulnerability Assessment and Penetration Testing. It is two related but different pieces of work, usually sold together, and the difference matters when you are buying it.
Vulnerability assessment vs penetration testing
A vulnerability assessment is breadth-first. Automated scanners and manual checks enumerate every host, port, service and application in scope and list the weaknesses they can identify: missing patches, weak TLS configuration, default credentials, outdated libraries, dangerous HTTP headers. The output is a wide inventory of what could be wrong.
A penetration test is depth-first. A tester takes those findings and tries to actually exploit them, chaining small issues into a real attack path — for example, an information-disclosure bug that reveals a username, plus a login page with no rate limiting, plus a weak password policy, becomes full account takeover. Individually those three findings look like "low" severity. Chained, they are critical.
| Vulnerability assessment | Penetration test | |
|---|---|---|
| Goal | Find as many weaknesses as possible | Prove what an attacker could actually do |
| Method | Mostly automated, plus manual review | Mostly manual, human-led |
| Output | Prioritised list of weaknesses | Exploited attack paths with evidence |
| Typical duration | 2–4 days | 1–2 weeks |
Why businesses in Bangladesh need VAPT
- Regulatory pressure. Bangladesh Bank's ICT security guideline expects regulated financial institutions to run periodic security testing of internet-facing systems, and the Cyber Security Act framework raises the cost of a breach involving personal data.
- Customer and partner requirements. Enterprise clients increasingly ask for a recent penetration test report before they will sign. A current report shortens your sales cycle.
- Real exposure. E-commerce platforms, fintech apps, hospital systems and government portals in Bangladesh are actively scanned and attacked. Automated attacks do not care how small your company is.
- Cost. Fixing a vulnerability found in testing costs a fraction of responding to a live breach, notifying customers and rebuilding trust.
What gets tested
A VAPT engagement is scoped around your assets. Common scopes include:
- Web applications — authentication, session management, access control, injection, business-logic abuse, file upload, payment flows.
- APIs — REST and GraphQL endpoints, broken object-level authorisation, mass assignment, rate limiting.
- Mobile applications — Android and iOS binaries, local storage, certificate pinning, the backend the app talks to.
- Networks — external perimeter and internal segments, misconfigured services, lateral movement.
- Cloud and servers — IAM policy, storage exposure, container and host hardening.
How an Oriole Security VAPT engagement runs
1. Scoping
We agree exactly what is in scope, what is explicitly out of scope, which environment is used (staging that mirrors production is ideal), the test window, and who to call if something breaks. You get a fixed price before anything starts.
2. Reconnaissance and mapping
We map the attack surface: every route, parameter, role and integration. For an authenticated application we ask for at least two accounts per role so we can test whether one user can reach another user's data.
3. Testing
Automated scanning first for coverage, then manual testing for everything a scanner cannot understand — authorisation, workflow abuse, race conditions, chained exploitation. Our testers hold OSCP, CISSP and CEH certifications and follow OWASP and PTES methodology.
4. Reporting
You get an executive summary written for management, plus a technical section per finding with severity (CVSS), affected endpoint, reproduction steps, screenshots or request/response evidence, business impact and a specific fix — not "sanitise your input" but the change to make in your code or configuration.
5. Retest
After your team deploys fixes we retest the findings and issue an updated report you can hand to a client, an auditor or a regulator.
What a good VAPT report is not: a raw export from a scanner with 400 "informational" rows and no exploitation attempt. If a vendor cannot show you a redacted sample report before you buy, that is what you are getting.
How often should you test?
At minimum once a year, and additionally after any significant change: a new payment provider, a major framework upgrade, a new customer-facing feature, or a migration to a new host. Continuous delivery teams often pair an annual full VAPT with lighter testing each quarter.
Preparing for your first test
- Write down your asset list — domains, subdomains, IPs, mobile apps, APIs.
- Prepare test accounts for every user role, plus test data that is safe to modify.
- Tell your hosting provider and WAF vendor the test window so they do not block the testers mid-engagement (or ask for the WAF to stay on, if you want to test it too).
- Decide who owns remediation before the report lands. Reports that arrive with no owner do not get fixed.
Oriole Security runs VAPT engagements for banks, fintechs, e-commerce platforms and government suppliers across Bangladesh. See our full service list, or book a free 30-minute consultation to scope your first test.