Frequently Asked Questions
Answers about security testing, access, pricing and what happens after an assessment.
Questions Your Team May Be Asking.
How are our information and findings handled?
Before sharing access, agree confidentiality terms, authorised recipients, the secure handover method and how long reports and evidence will be retained. Use test accounts and synthetic data where practical, and arrange credential revocation at handover. Confirm any NDA or data-processing requirements during scoping.
What is VAPT, and how is it different from a scan?
Vulnerability Assessment and Penetration Testing (VAPT) identifies weaknesses and checks their practical impact within an agreed scope. An automated scan is one input; manual review is important for user permissions and business workflows. The proposal should state the testing depth and methods included.
Can you assess a small application or a limited set of servers?
Start with the assets that matter most: an application, selected APIs, servers or an agreed network range. We clarify asset ownership, user roles, integrations and exclusions before preparing a scope.
Who makes the fixes: Anvexa or our team?
Your developers, hosting provider or IT team implement changes unless implementation support is separately agreed. Anvexa explains the findings and recommended fixes. If you need additional development help, discuss its scope and responsibilities before work begins.
Will testing interrupt our website or business?
Testing can affect systems. We agree the environment, testing window, contacts, exclusions and stop conditions before starting. Staging or test data may be appropriate; production testing needs explicit authorisation and coordinated safeguards. Availability cannot be guaranteed.
How much does it cost, and how long does it take?
The quote depends on application complexity, user roles, API endpoints, hosts, access arrangements and testing depth. After scoping, the written proposal sets the fee, schedule, deliverables and retest window. Fix implementation time depends on your team and the issues found.
Do you need source code, passwords or personal data?
Access depends on whether testing is external, authenticated or includes code review. Agree the minimum access needed and a secure way to share it. Test accounts and synthetic data are preferable where practical. Keep passwords, keys, patient records and confidential findings out of the enquiry form.
Does a VAPT report make us DPDP compliant or certified?
Testing supports security readiness and evidence, but compliance includes legal, organisational and operational duties too. If a customer or regulator requires a CERT-In-empanelled auditor, a particular assessor or report format, flag that during scoping so eligibility and requirements can be confirmed before commissioning.
What happens after our developers fix the findings?
Submit agreed fixes for retesting within the proposal’s retest window. Verification records distinguish resolved findings, issues that remain and testing limitations. Further assessments can be planned after major changes or on an agreed recurring schedule.