VAPT and cybersecurity services
Find your weak spots before attackers do, and fix them with our help.
- Testing
- Infra · Web app
- Endpoints
- Defender for Endpoint
- Approach
- Zero trust
- Includes
- Remediation support
Who our VAPT service is for
Our VAPT services test your infrastructure and applications the way an attacker would, then help you fix what we find. You get a prioritised report, a findings walkthrough call, a remediation tracker and hands-on remediation support.
- Companies asked for a VAPT report by a customer, auditor or regulator
- Teams launching a web application or customer portal
- Organisations with Microsoft 365 or Defender licences that are not fully configured
- Businesses that have had a security incident and want an independent review
Before
- No idea which systems are exposed
- Defender licences paid for but not set up
- A customer asking for a VAPT report you don't have
After
- A prioritised list of real risks with evidence
- Endpoints protected and tuned
- A report and remediation tracker you can share
What you get from VAPT and penetration testing
Named documents and outcomes you keep. Scope is agreed per engagement.
- 01
Scoped test plan
Targets, test types, rules of engagement and testing windows, agreed in writing.
- 02
Findings report
Each finding with risk rating, CVSS score, evidence and affected asset.
- 03
Executive summary
Plain-language overview of the risk for management and customers.
- 04
Remediation guidance
Specific steps to fix every finding, in priority order.
- 05
Remediation tracker
Each finding with its owner, fix and status, kept current while fixes are applied.
- 06
Findings walkthrough call
A call to walk your team through each finding and the fix.
- 07
Hardening checklist
Baseline settings to apply so the same issues do not return.
How a VAPT engagement runs
Open each phase to see what it produces and who does what.
Sample VAPT deliverable
An illustrative sample with placeholder names and data, not a real client document.
Stored cross-site scripting in profile name
HighCVSS v3.1 base 7.6 (sample)- Affected asset
- app.example.com /account/profile
- Remediation
- Remediation owner: Dev team
- Description
- The profile name field accepts script content that runs when other users view the profile.
- Evidence
- POST /api/profile name=redacted
Response 200 · payload rendered on /u/id - Remediation
- Encode output in templates, validate input server-side and add a Content Security Policy.
VAPT engagement formats
Fixed-scope project
- When it fits
- You have a defined outcome: a migration, a test, a certification or a rollout.
- Included
- Agreed deliverables, a named lead, progress updates and handover.
- How it is priced
- Quoted after a scoping call; the price depends on the number of users, sites, applications or controls in scope.
Ongoing support retainer
- When it fits
- You want someone to run, monitor and improve things month after month.
- Included
- Monitoring, changes, reviews and a monthly report within an agreed scope.
- How it is priced
- A monthly fee quoted after a scoping call, based on users, devices and systems covered.
Advisory hours
- When it fits
- Your team does the work and wants expert review or answers.
- Included
- Calls, document and design reviews, and written recommendations.
- How it is priced
- A block of hours agreed in advance; the rate is quoted after a short call.
VAPT tools we use
- Bitdefender
- Quick Heal
- Firewalls
- VPN
- VAPT
ITCCS is an independent consultancy. Product names and logos are trademarks of their respective owners, shown only to identify the platforms we work with. No partnership, certification or endorsement is implied.
Standards for VAPT
- ISO/IEC 27001Information security, certification-ready ISMSLearn moreRead about ISO/IEC 27001
- NIST CSF 2.0Security programme baselineLearn moreRead about NIST CSF 2.0
- CIS Controls v8.1Practical hardening prioritiesLearn moreRead about CIS Controls v8.1
- PCI DSSCard data security readinessLearn moreRead about PCI DSS
We implement and prepare organisations for these standards. Certification is issued by accredited bodies.
Related certifications
- CISM: Certified Information Security ManagerHeld
- CompTIA Security+Held
- CCSK: Certificate of Cloud Security KnowledgeHeld
A vulnerability assessment finds known weaknesses using scanners. A penetration test goes further: we try to exploit them manually to show the real business impact.
We agree testing windows in advance, avoid destructive techniques on production and stop immediately if a test affects availability.
An executive summary, each finding with severity, evidence and affected assets, and step-by-step remediation guidance your team can act on.
Yes. We can work alongside your team or carry out the remediation ourselves, with a tracker showing each finding's owner, fix and status.
The number of applications, IP addresses, APIs and user roles in scope, whether testing is black-box or authenticated, and whether internal network testing is included.
We use named accounts with the least access needed, prefer your own admin tools over shared passwords, move files only through encrypted channels and remove our access at handover. For VAPT we test only the targets and windows signed off in the rules of engagement, from a declared source IP, and keep evidence encrypted until the report is delivered. Our full practices are on our Trust page.
You receive the report, walk through it with us on a call, and fix findings with our support and a remediation tracker. Many clients then repeat testing yearly or after major changes.
Let's build what's next.
Tell us about your infrastructure, security or automation goals. We reply with questions, then a written plan with scope and next steps.
- Response
- Usually within one business day
- Location
- Worldwide
What happens next
- 01
Reply
- 02
Discovery call
- 03
Proposal