VAPT gets thrown around as one word, but it's two different things done together: Vulnerability Assessment (finding weaknesses) and Penetration Testing (trying to actually exploit them). For most small and mid-size businesses, what's practical and useful is closer to a thorough vulnerability assessment with some manual verification — not a full adversarial pentest, which is a heavier, more specialized engagement.
What actually happens during a scan
- Port and service discovery — using tools like Nmap to find every open port on every device on the network, including ones nobody remembers opening
- Vulnerability scanning — tools like Nessus or OpenVAS check each system against a database of known vulnerabilities (outdated software, missing patches, weak configurations)
- Traffic analysis — checking what's actually moving across the network, sometimes surfacing things like unencrypted traffic or unexpected connections
- Manual verification — not every "finding" a scanner reports is real or exploitable; part of the job is checking which ones actually matter
What a real engagement covers
On a 100+ endpoint assessment I did for a financial services client, this meant running Nmap across the network to map open ports, followed by Nessus and OpenVAS scans on servers and workstations, then compiling findings by severity and working through fixes with the internal team — unnecessary open ports closed, outdated software flagged for patching, weak firewall rules tightened.
A separate 60-endpoint scan for another client followed the same pattern at smaller scale: scan, prioritize by risk, fix, re-scan to confirm.
What a report should actually tell you
- What was found, and where exactly
- Severity — critical, high, medium, low, based on actual exploitability, not just a generic scanner score
- What it would take for someone to actually exploit it
- The specific fix — a patch version, a config change, a rule to add
How often to do it
For most small offices, a full scan once or twice a year is reasonable, with a lighter check after any major change — a new server, a new firewall, a new office network. Businesses handling financial or health data, or with compliance requirements, should look at quarterly.
One honest note: a scan is a snapshot. New vulnerabilities get discovered constantly, so "we did VAPT last year" doesn't mean the network is safe today — it means it was reasonably safe at the time of scanning.