Description
VAPT – Network + Web + API + Endpoint
By Sherlocked Security – Offensive Security & Cyber Risk Experts
Full Service Description
Vulnerability Assessment and Penetration Testing (VAPT) is a comprehensive security engagement designed to identify, validate, and demonstrate exploitable weaknesses across an organization’s digital ecosystem.
Sherlocked Security provides independent VAPT services through the Make Audit Easy platform, covering network infrastructure, web applications, APIs, and endpoint systems.
Our assessment follows a structured, risk-based, and evidence-driven methodology aligned with internationally recognized frameworks, including:
-
OWASP Top 10
-
OWASP API Security Top 10
-
NIST SP 800-115
The engagement combines advanced automated scanning with controlled manual exploitation techniques to simulate real-world attacker behavior across multiple layers of the IT environment.
We evaluate external and internal attack surfaces, endpoint configurations, authentication and authorization mechanisms, business logic vulnerabilities, API exposure risks, and privilege escalation paths. All findings are validated to eliminate false positives and prioritized based on technical severity and business impact.
The engagement culminates in a detailed technical and executive-level report with clear, risk-ranked remediation guidance.
| Parameter | Basic | Standard | Enterprise | Advance |
| Audit Mode | Virtual Only | Virtual Only | Virtual + Onsite | Virtual + Onsite |
| Network Assets (IPs / Devices) | Up to 8 | Up to 20 | Up to 40 | Up to 80–100 |
| Web Applications | 1 Website | 1 Website | 2 Websites | 3–4 Websites |
| Web Pages (per app) | Up to 5 | Up to 8 | Up to 12 | Up to 20–25 |
| API Endpoints | Up to 8 APIs | Up to 20 APIs | Up to 40 APIs | Up to 80–100 APIs |
| Authentication Testing | Basic login | Standard auth | Full auth + RBAC | Complex roles & abuse |
| Authorization Testing | Very limited | Limited | Comprehensive | Extensive |
| Business Logic Testing | Minimal | Moderate | Standard industry depth | Deep / edge cases |
| OWASP Coverage | OWASP Top 10 | OWASP Top 10 | OWASP + API Top 10 | OWASP + API + Custom |
| Manual Exploitation | Minimal | Partial | Included | Extensive |
| False Positive Validation | Critical only | High & Critical | All severities | All severities |
| Add On | ||||
| Additional Network Asset | 10% | 7% | 7% | 5% |
| Additional Web Page | 10% | 7% | 5% | 5% |
| Additional API Endpoint | 10% | 7% | 5% | 5% |
| Onsite (Same City) | NA | NA | 15% | 10% |
| Onsite (Another City) | NA | NA | 20% | 15% |
| Timeline | ||||
| Audit Timeline | 3–11 Days | 5–11 Days | 10–20 Days | 15–30 Days |
| Post-Audit Support | 5 Months | 5 Months | 7 Months | 11 Months |
*TC
Key Testing Coverage
Network Security Testing
-
External & internal network assessment
-
Open ports & exposed services review
-
Firewall & segmentation validation
-
Lateral movement simulation
-
Misconfiguration & patch exposure detection
Web Application Security Testing
-
Injection vulnerabilities (SQLi, XSS, etc.)
-
Broken authentication & session flaws
-
Access control bypass
-
Security misconfigurations
-
Business logic abuse testing
API Security Testing
-
Broken Object Level Authorization (BOLA)
-
Token misuse & authentication weaknesses
-
Excessive data exposure
-
Rate limiting bypass
-
Endpoint & parameter manipulation
Endpoint Security Testing
-
Operating system misconfigurations
-
Local privilege escalation
-
Weak password policies
-
Patch & update assessment
-
Antivirus / EDR effectiveness review
-
Persistence mechanism testing
Who This Service Is For
-
SaaS & Product Companies
-
FinTech & Payment Platforms
-
E-commerce Businesses
-
Enterprises with distributed endpoints
-
Organizations preparing for ISO 27001, SOC 2, PCI DSS, RBI, SEBI, or IRDAI compliance
-
Companies seeking full-spectrum security validation
Why Sherlocked Security
-
Offensive security-driven methodology
-
Independent and objective validation
-
Hybrid manual + automated testing
-
Clear, developer-friendly remediation guidance
-
Risk-based reporting aligned to business impact
Reviews
There are no reviews yet.