GUARDIAN ASSESSMENT · STANDALONE SERVICE
VAPT Service — Standalone Vulnerability Assessment & Penetration Testing
Guardian Assessment Pvt. Ltd. offers Vulnerability Assessment and Penetration Testing (VAPT) as a standalone service — independent technical security testing of web applications, SaaS platforms, and APIs, aligned to OWASP standards. VAPT produces findings and a technical report; it does NOT produce an accredited certificate, a public directory listing, or surveillance throughout a cycle. VAPT is a distinct service category from Guardian SecureApp™ accredited certification, designed for engineering teams who need rigorous independent technical validation without the procurement-grade infrastructure that certification carries. This page describes what VAPT is, when it is the right choice, and the structural boundaries — particularly the 12-month cooling-off period — that govern subsequent certification engagements.
What VAPT Is and What It Is Not
A Standalone Technical Service
Vulnerability Assessment and Penetration Testing — VAPT — is the industry term for independent technical security testing of an application or system. It combines automated vulnerability assessment (scanning for known weakness patterns) with manual penetration testing (where a skilled tester actively probes the system in ways that automation cannot). The output is a technical findings report: a documented inventory of vulnerabilities and weaknesses identified during testing, with severity classification and reproduction evidence.
Guardian Assessment Pvt. Ltd. offers VAPT as a standalone service for engineering teams who need rigorous independent technical validation. Our VAPT methodology is aligned to the same OWASP standards we apply during accredited certification — OWASP ASVS for web applications and SaaS platforms, OWASP Top 10 as a prioritisation lens, and OWASP API Security Top 10 for API surfaces. The same severity classification scheme applies (Critical / High / Medium / Low / Informational). Our evaluators are the same evaluators who conduct certification engagements, applying the same technical depth.
What VAPT does not produce is an accredited certificate. A VAPT engagement does not result in: a Guardian SecureApp™ certificate; a Public Scope Statement; a Public Directory listing at /directory; surveillance audits during a cycle; a Mark Usage License authorising display of any certification mark on the tested product. These deliverables are exclusively the output of accredited certification under our ISO/IEC 17065 accreditation. VAPT is a different category of service — and that is precisely the point.
This distinction matters because the two services serve different needs. A VAPT engagement gives an engineering team a high-quality technical findings report — useful for internal remediation, useful as input to internal security improvement, useful as evidence to non-Guardian audits or assessments. An accredited certification engagement adds a procurement-grade attestation: an issued certificate, public verifiability, ongoing surveillance, and the procedural infrastructure that makes the certificate meaningful to procurement teams, regulators, and external auditors. If your need is technical validation, VAPT may be the right fit. If your need is procurement-grade evidence, accredited certification is the right fit. Many products legitimately need only one; some products need both at different stages of their lifecycle.
Guardian’s UAF accreditation: Guardian Assessment Pvt. Ltd. is accredited by United Accreditation Foundation (UAF) under ISO/IEC 17065:2012 (accreditation 52605385601, valid until 05 May 2030) for product certification — specifically the Guardian SecureApp™ scheme. This accreditation does NOT extend to VAPT. VAPT is a non-accredited commercial service offered by Guardian as an organisation. Buyers comparing Guardian VAPT to other VAPT providers should evaluate on technical capability, evaluator quality, and methodology — accreditation does not differentiate VAPT engagements.
Choice
Identifying the Right Tool for the Job
VAPT is the appropriate engagement for several specific scenarios. Identifying which scenario describes your need — and importantly, whether your need actually requires VAPT or accredited certification — is the most important pre-engagement decision. The most common VAPT scenarios are below.
Pre-Release Product Validation
A product still in development, before commercial release, cannot be certified — Guardian SecureApp™ certifies released products at specific versions. But pre-release products often warrant rigorous independent technical validation, particularly where security architecture decisions are being finalised, where regulatory deadlines align with release windows, or where investor or board confidence requires third-party security evidence before launch. VAPT engagements are well-matched to this scenario: they provide rigorous testing without requiring the product to be release-ready, and findings inform engineering work before the version that will eventually be certified.
Note the cooling-off implication: a pre-release VAPT for a product that the applicant intends to certify creates the 12-month cooling-off period before certification of the same product can be conducted by Guardian (Section 3.6 below). Where the regulatory deadline is tight, this matters substantially — applicants planning both pre-release VAPT and certification within an aggressive timeframe may need to choose between Guardian VAPT plus certification by another accredited body, or skipping pre-release VAPT and proceeding directly to Guardian certification.
Pre-Certification Preparation (with cooling-off implications)
Some applicants engage VAPT specifically to identify and remediate findings before applying for accredited certification — a ‘rehearsal’ for the technical evaluation phase of certification. The pattern reduces the risk of finding-closure delays during the certification engagement itself. However, if VAPT is conducted by Guardian, the 12-month cooling-off applies to subsequent Guardian certification of the same product. This makes Guardian-VAPT-then-Guardian-certification a 12+ month sequence — appropriate only where time-to-certificate is not on a tight critical path. Applicants needing pre-certification testing followed by rapid Guardian certification should engage non-Guardian VAPT providers for the pre-certification phase, then come to Guardian for certification.
Internal Security Validation
Engineering teams conducting their own internal security review may want third-party validation of internal findings, or a fresh perspective from an external evaluator with no internal-context bias. VAPT serves this need — providing independent technical findings that can be compared against internal findings, with disagreements (where Guardian’s evaluators identify issues the internal team did not, or vice versa) being valuable signal for the internal security programme. This use of VAPT does not typically lead to certification, so cooling-off is not a planning concern.
Supplementary Technical Testing
Companies certified by other accredited bodies — for ISO/IEC 27001 by 17021-1-accredited bodies, for SOC 2 by AICPA-aligned auditors, for sector-specific certifications by domain bodies — may want supplementary technical testing on specific products that the broader certifications do not address at sufficient depth. Guardian VAPT can fill this gap, providing OWASP-aligned application-security findings that complement the broader certifications. This pattern does not interact with Guardian certification (the products are not Guardian-certified), so cooling-off does not apply.
One-Off Procurement Requirements
Some procurement processes accept independent VAPT reports as security evidence, without requiring accredited certification. Where the procurement requirement is for ‘an independent VAPT report from a competent provider’ rather than ‘an accredited certification’, VAPT is the more efficient and appropriate response. Where the procurement requirement is for ‘an accredited certification’ or ‘ISO/IEC 17065-anchored evidence’, certification is required and VAPT is not a substitute.
Routine Periodic Testing
Engineering teams that conduct annual or biannual penetration testing as a matter of routine security practice — independent of any specific procurement or certification requirement — may engage VAPT on a periodic basis. This pattern does not interact with Guardian certification (the testing is for internal assurance, not external attestation), so cooling-off does not apply.
Comparison
Choosing Between the Two Services
The clearest way to distinguish the two services is a direct side-by-side comparison. Both share substantive technical depth — the same evaluators, the same OWASP standards, the same severity scheme, the same finding-handling discipline. Where they differ is in the procedural infrastructure that converts technical evaluation into procurement-grade attestation.
| Dimension | VAPT (this page) | Guardian SecureApp™ Certification |
|---|---|---|
Service Category | Standalone technical service, non-accredited. | ISO/IEC 17065-accredited product certification. |
Output Deliverables | Technical findings report; executive summary; severity-classified findings inventory; reproduction evidence. | Accredited Certificate; Public Scope Statement; Public Directory listing; Mark Usage License; Evaluation Report. |
Public Verifiability | None. VAPT report is private to the client. | Yes. Public Directory at /directory; certificate publicly verifiable. |
Decision Authority | Not applicable. No certification decision is made. | Independent Decision Authority per ISO/IEC 17065 Cl. 7.6, separate from the evaluation team. |
Ongoing Surveillance | None. VAPT is point-in-time. | Annual, L1 and L2, or semi-annual, L3, surveillance throughout the 3-year cycle. |
Mark Usage | Not authorised. No mark. | Mark Usage License authorising display of Guardian SecureApp™ certification mark on the certified product. |
OWASP Standards Coverage | Same standards, ASVS, Top 10 and API Top 10, at agreed depth. | Same standards at level-appropriate depth: 1 Basic, 2 Advanced, 3 High-Risk Critical. |
Severity Classification | Same five-level scheme: Critical / High / Medium / Low / Informational. | Same five-level scheme. |
Findings Re-Verification | Optional, quoted as an additional service if required. | One round included; additional rounds billable. |
Procurement Acceptability | Accepted where procurement specifies independent VAPT; not accepted where procurement specifies accredited certification. | Accepted across procurement contexts requiring accredited or ISO/IEC 17065-anchored evidence. |
Cooling-Off Implication | Guardian VAPT for a product creates a 12-month bar to subsequent Guardian certification of the same product, Cl. 4.2. | None. Certification can be followed by recertification or other Guardian engagements without cooling-off. The impartiality boundary applies in the other direction. |
Engagement Pricing Model | Scope-quoted only; bespoke per engagement. | Indicative starting prices published; tailored quote at scoping. |
In substantive technical terms, VAPT and certification share the same DNA — same evaluators, same standards, same severity scheme. The structural difference is everything that surrounds the technical evaluation: the procedural infrastructure, the public verifiability, the ongoing surveillance, the procurement-grade attestation. That difference is what determines which service is right for your need.
Methodology
How Guardian Conducts VAPT Engagements
Guardian VAPT engagements follow a structured methodology — adapted to the bespoke scope of each engagement but consistent in core technical activities. The methodology mirrors the technical evaluation activities of certification engagements (because the evaluators and standards are the same) without the procedural overhead that certification adds (the application form, the formal decision authority, the certificate issuance, the public listing). The methodology phases are below.
Phase 1 — Scoping
Initial scoping conversation establishes the in-scope product surface, the testing depth required (matched roughly to certification Levels — but without formal Level designations since VAPT does not produce a certificate), the OWASP standards in scope (ASVS for web/SaaS, OWASP API Security Top 10 for APIs, or combinations), the access provisioning requirements (test credentials, environment access, source code access if applicable), and the engagement timeline. The scoping conversation produces a scope-specific quote and an Engagement Plan.
Phase 2 — Documentation Review
Light-touch review of available product documentation — architecture, data flow, authentication / authorisation design — to inform the testing plan. Less substantive than Stage 3 of certification engagements (because no formal certification scope statement is being constructed) but sufficient to focus testing effort and avoid testing in the dark. Where documentation is sparse, this phase may include short documentation-development collaboration with the applicant.
Phase 3 — Technical Testing
The core VAPT activity. Activities scale with engagement depth and scope, typically including: automated vulnerability scanning (DAST against running application, SCA against dependencies, secrets scanning where source provided); manual penetration testing focused on the agreed scope (single-role or multi-role authenticated testing depending on engagement depth); business-logic and abuse-case testing; configuration and hardening review; source code review where source is provided and scope includes it. The testing is conducted to the same technical depth as Stage 4 of certification engagements at the matched depth tier.
Phase 4 — Findings and Reporting
Findings are progressively communicated during testing — same discipline as certification, with the applicant receiving issue-level details (description, evidence, severity, OWASP/CWE/MITRE references) as findings are validated. The Technical Findings Report is delivered at end of testing: comprehensive document covering all findings (open and closed), severity-classified, with executive summary suitable for sharing with non-technical stakeholders. The report is the principal VAPT deliverable.
Phase 5 — Optional Re-Verification
Re-verification of corrective actions is OPTIONAL in VAPT engagements (unlike certification, where one round is included as standard). Where the applicant wishes Guardian to re-verify remediation, this is scoped and quoted as additional engagement effort. Many VAPT clients self-verify their own remediation rather than engaging Guardian for re-verification — the choice depends on the client’s internal capacity and external-validation requirements.
This methodology is bespoke per engagement — adjusted to the scope, the agreed testing depth, the technology stack, and any specific applicant priorities. No two VAPT engagements are identical, which is part of why VAPT is scope-quoted only rather than priced from a published starting figure.
Report
What You Get from a VAPT Engagement
The principal deliverable of a VAPT engagement is the Technical Findings Report. The report’s structure, severity classification scheme, and content discipline mirror those of certification Evaluation Reports — because the underlying technical evaluation discipline is the same. The report sections and severity scheme are described below.
Severity Classification
Findings are classified using the same five-level scheme used in Guardian SecureApp™ certification engagements:
- Critical — severe immediate impact: direct exploitability, sensitive-data exposure, full account or system compromise, regulatory breach risk.
- High — material impact requiring concentrated effort to exploit, or where exploitation produces significant but not catastrophic consequence.
- Medium — limited or contextual impact, requires specific conditions or adjacent vulnerabilities to be material.
- Low — minor impact: defence-in-depth concern, non-default configuration variant, low probability of meaningful exploitation.
- Informational — observation rather than vulnerability: best-practice guidance, future-proofing, contextual notes.
Severity classification is informed by — though not solely determined by — the OWASP Top 10 / API Top 10 categories the finding maps to. The classification reflects evaluator judgment based on the specific exploitation context, applicant’s environment, and adjacent control posture. Severity is not negotiated with the applicant; this is one of the technical-integrity safeguards that distinguishes Guardian VAPT from VAPT services where finding severity is influenced by client preference.
Per-Finding Content
Each finding in the Technical Findings Report includes:
- Finding ID and title
- Severity classification
- Affected component / endpoint / functionality
- Description of the vulnerability or weakness
- Reproduction steps (sufficient to validate the finding independently)
- Evidence (screenshots, request/response captures, code excerpts where applicable)
- Standards mapping (OWASP ASVS requirement, OWASP Top 10 / API Top 10 category, CWE identifier)
- MITRE ATT&CK technique mapping where applicable (typically for higher-severity findings)
- Status (open / remediated / accepted as residual / re-verified) — populated as engagement progresses
Report Sections
The Technical Findings Report is delivered as a structured document containing:
- Executive Summary (1–2 pages, suitable for sharing with non-technical stakeholders)
- Engagement Overview (scope, methodology, timeline, evaluator team)
- Findings Summary (severity-classified count, distribution across OWASP categories)
- Detailed Findings (the principal section, with full per-finding content)
- Methodology Appendix (testing tools, manual testing approach, OWASP standards versions referenced)
- Limitations Appendix (anything explicitly out of scope, time-constrained limitations, environment-specific factors)
Re-Verification Confirmations
Where the applicant engages Guardian for re-verification of corrective actions (optional, quoted separately), the Technical Findings Report is updated with re-verification status: each remediated finding is marked as ‘Re-verified — closed’ or ‘Re-verification failed — issue persists’ with explanation. The updated report becomes the final engagement deliverable.
Important Boundaries
The Technical Findings Report is a technical document. It documents what Guardian’s evaluators identified during the bespoke testing engagement. It does NOT:
- Make any conformance attestation (no statement of conformance to OWASP standards or any other framework)
- Authorise display of any certification mark or accreditation symbol
- Carry any procurement-grade attestation weight beyond what readers of the report independently determine
- Receive surveillance or maintenance — the report is point-in-time
- Appear in any public directory — the report is private to the applicant
Buyers reading a VAPT report (where applicants share their VAPT report with procurement teams) should evaluate it on technical merit. The report’s value is technical depth and evaluator independence, not procedural attestation.
Cooling-Off Boundary
The Most Consequential Editorial Element on This Page
This section is the most consequential editorial element on the page. Read it carefully if you are considering Guardian VAPT alongside any present or future Guardian SecureApp™ certification of the same product.
The Rule
Guardian Assessment Pvt. Ltd. cannot accept an application for Guardian SecureApp™ certification of a product within 12 months of completing a VAPT engagement on the same product. The 12 months is calculated from the date of the Technical Findings Report (or the final re-verification confirmation, whichever is later) to the date of the certification application.
Why This Rule Exists
The rule is an impartiality requirement under ISO/IEC 17065 Clause 4.2. The standard requires certification bodies to identify and manage threats to impartiality — including specifically the threat that arises when a body has provided consultancy-adjacent services on a product and then evaluates the same product for certification. Even where the consultancy-adjacent service was conducted with rigorous separation (as Guardian VAPT is — no remediation guidance, no advisory beyond findings reporting), the structural relationship between provider and product creates an impartiality concern that procedural separation alone cannot fully resolve. The 12-month cooling-off is the operational period that allows the relationship between Guardian and the product to reset before certification can proceed.
Practical Consequences
- Pre-release VAPT followed by Guardian certification: 12+ month sequence. If your release is in 9 months and you want both Guardian VAPT and Guardian certification, the timing does not work — you must choose one for Guardian and seek the other from a different provider.
- Pre-certification VAPT (rehearsal): if you specifically want Guardian VAPT as preparation for Guardian certification, plan for 14+ months total elapsed time (12-month cooling-off plus the certification engagement itself). Most applicants who want pre-certification rehearsal engage non-Guardian VAPT providers for that phase, then come to Guardian for certification.
- VAPT for one product, certification for a different product: no cooling-off. The 12-month rule applies to the same product. Where an applicant has multiple distinct products, Guardian VAPT on Product A and Guardian certification on Product B can run concurrently or sequentially without cooling-off restriction.
- VAPT followed by recertification (where certification existed before VAPT): the cooling-off rule applies to certification engagements that follow VAPT. Existing certified clients should not engage Guardian VAPT on their certified product during the certification cycle — doing so could compromise the certification’s continuation. Where an existing certified client wants supplementary technical testing during the cycle, this should be discussed with Guardian’s Decision Authority for guidance on impartiality implications.
Alternatives Within the Cooling-Off Period
If you have engaged Guardian VAPT and need accredited certification of the same product within the 12-month cooling-off period, the appropriate path is to engage a different ISO/IEC 17065-accredited certification body — there are several internationally and several within India. Guardian can refer applicants to other accredited bodies in this situation; we do not have a referral fee structure (which would itself create impartiality concerns), and our referrals are made based on the applicant’s specific Module + Level needs and the other bodies’ accreditation scope.
After the Cooling-Off Period
Once the 12-month cooling-off period expires, the applicant is free to apply for Guardian SecureApp™ certification of the same product. The prior VAPT engagement is not held against the application — application review proceeds normally per ISO/IEC 17065 Clause 7.3. The certification engagement, if approved, runs through the standard five-stage structure described on /process/stages.
Plan ahead: The 12-month cooling-off rule is the single most important planning consideration when choosing between Guardian VAPT and another VAPT provider. Where time-to-certificate matters, factor cooling-off into your provider-selection decision before engaging. Once a Guardian VAPT engagement starts, the 12-month clock starts and is not negotiable.
Engagement Profile
What a VAPT Engagement Looks Like
Because VAPT is bespoke per engagement, there is no published rate card for VAPT pricing or duration. What follows is an indicative engagement profile — the typical shape of a VAPT engagement at three rough depth tiers. These are not Levels (Levels are specific to certification); they are shorthand for engagement-depth quotation. The actual scope, depth, duration and pricing for your engagement are quoted in writing during scoping conversation.
| Indicative Depth Tier | Typical Duration | Typical Coverage |
|---|---|---|
Focused VAPT | 1-3 weeks | Specific feature, endpoint, or limited scope. DAST plus light manual testing plus targeted business-logic checks. OWASP Top 10 prioritisation lens; ASVS or API Top 10 reference at a sampling depth. |
Standard VAPT | 3-6 weeks | Whole-product surface at moderate depth. DAST plus comprehensive manual testing, multi-role authenticated testing where applicable, business-logic and abuse-case testing, and configuration review. OWASP ASVS L2-equivalent depth or OWASP API Top 10 comprehensive coverage. |
Comprehensive VAPT | 6-12 weeks | Whole-product surface at substantial depth. All Standard activities plus source code review where applicable, threat-led testing, chained-attack scenarios, and comprehensive abuse-case modelling. OWASP ASVS L3-equivalent depth or comprehensive Module C-equivalent depth. |
Engagement durations assume single-product scope and adequate applicant responsiveness during testing. Combined-surface engagements (web app + API together, or multi-product engagements) run longer. Engagements where access provisioning or applicant responsiveness is constrained run longer. Specific timing for your engagement is confirmed in the Engagement Plan provided after scoping.
Pricing
Guardian VAPT is scope-quoted only — there are no published starting figures for VAPT pricing. The reasoning: VAPT scope variability is substantial enough that published ‘from X’ figures would create misleading anchor expectations more often than they would inform planning. Tailored pricing for your specific engagement is provided in writing during scoping conversation, with the bespoke nature of the engagement reflected in the quote. Scoping conversation is no-charge, no-commitment; initiate at /quote with VAPT context flagged.
Engagement Phases
A typical end-to-end VAPT engagement — from initial enquiry to delivered Technical Findings Report — runs:
- Scoping conversation: 3–5 business days to scope quote
- Engagement agreement and access provisioning: 1–2 weeks
- Documentation review (Phase 2): 2–5 days
- Technical testing (Phase 3): per the depth tier above (1–12 weeks)
- Findings reporting (Phase 4): 3–7 days for report finalisation after testing completes
- Optional re-verification (Phase 5): typically 1–2 weeks if engaged
Engagement
Initiating a VAPT Engagement
The path to engaging Guardian for VAPT is straightforward and shares some structural elements with certification (because the scoping discipline is similar) while avoiding the procedural overhead of certification (because no certificate is being issued).
Initial Enquiry
Initiate at /quote with VAPT context flagged (the quote form has a service-type field; selecting VAPT routes the enquiry to our VAPT scoping team rather than the certification scoping team — though the underlying evaluator capacity is shared). Alternatively, contact us via /contact and indicate VAPT in the message subject.
Scoping Conversation
Scoping conversation is scheduled within 3–5 business days. The conversation covers product scope (what’s in, what’s out), depth requirements (mapping to the Focused / Standard / Comprehensive tiers above or bespoke specifications), OWASP standards in scope, access provisioning expectations, timeline preferences, and any context-specific factors (regulatory drivers, parallel engagements, planned subsequent certification — important for cooling-off planning). The scoping conversation is no-charge and no-commitment.
Quote and Engagement Agreement
Following scoping, Guardian provides a written quote with engagement scope, methodology, timeline, deliverables, fees, payment terms and the cooling-off implications for any subsequent Guardian certification of the tested product. The quote is valid for 60 days. On acceptance, an Engagement Agreement is signed — this is a different document from the Certification Agreement (because VAPT is a different service category), with terms appropriate to the standalone-service nature of VAPT.
Engagement Kickoff
Once the Engagement Agreement is signed, kickoff is scheduled within 1–2 weeks. Kickoff confirms the engagement plan, confirms access provisioning, identifies the points of contact on both sides, and confirms timeline expectations. Phase 2 (Documentation Review) begins immediately after kickoff.
Throughout the Engagement
Findings are progressively communicated; the lead evaluator is the principal point of contact; escalation paths are agreed at kickoff. Engagement-management discipline is the same as for certification engagements (because the same evaluators apply the same engagement-management practice). The differences from certification are at the procedural-deliverables level, not at the day-to-day engagement-management level.
Delivery
The Technical Findings Report is delivered at engagement completion. Where re-verification is engaged, the updated report is delivered after re-verification. The engagement closes on report delivery (or after re-verification confirmation, whichever is later). There is no equivalent of the certification ‘cycle’ — VAPT is point-in-time. The 12-month cooling-off clock starts on engagement closure date.
Choice
When VAPT Is Not the Right Tool
This page has stated the impartiality boundary three times because it is the most consequential structural feature of accredited certification pricing. ISO/IEC 17065 Clause 4.2 — the impartiality requirement — explicitly addresses fee handling. The clause requires that fee structures must not influence certification decisions; this means several specific things in operational practice.
When Procurement Specifies Accredited Certification
If the buyer’s vendor security questionnaire, RFP, or contract terms specify ‘ISO/IEC 17065-accredited certification’, ‘accredited application security certification’, or ‘OWASP-aligned third-party certification’, VAPT is not a substitute. The procurement requirement specifies an attestation type that VAPT does not produce. Apply for Guardian SecureApp™ certification at the appropriate Module + Level.
When Regulators Reference Accredited Certification
Regulatory frameworks that explicitly reference ISO/IEC 17065 product certification — financial services regulators referencing third-party application security attestation, healthcare data regulators specifying accredited evidence, government IT regulators with specific accreditation requirements — typically do not accept VAPT as substitute evidence. Where the regulatory driver names accredited certification specifically, certification is the right path.
When You Need Public Verifiability
If your need is for evidence that buyers, regulators, or auditors can verify directly (without depending on you to share a private report), certification’s Public Directory at /directory is the answer — VAPT reports are not publicly listed. This matters in B2B sales where prospects want to verify your security claims independently before initiating evaluation conversations.
When You Need Mark Display Rights
If your marketing or product positioning would benefit from displaying a Guardian SecureApp™ certification mark (with appropriate scope and Level designation), only certification produces the Mark Usage License. VAPT does not authorise mark display. Mark misuse — claiming certification you don’t hold — has procurement and legal implications well beyond the immediate marketing concern.
When You Need Ongoing Assurance
VAPT is point-in-time. If your need is for ongoing assurance — annual or semi-annual surveillance, change-driven re-evaluation, continuous procurement-grade signal — only certification provides this through the 3-year cycle’s surveillance regime. Annual VAPT engagements provide periodic technical updates but do not provide the procedural infrastructure that surveillance under accreditation provides.
When the Cooling-Off Implications Don’t Work
If your timeline requires both VAPT and Guardian certification of the same product within 12 months, the cooling-off rule means you must choose one for Guardian. Most often, the right choice in this scenario is to skip Guardian VAPT and proceed directly to Guardian certification — certification’s Stage 4 Technical Evaluation is itself substantively the testing that VAPT would provide, with the additional procedural infrastructure that produces the certificate. Where you genuinely need both VAPT and certification within 12 months, engage non-Guardian VAPT and Guardian certification. None of these scenarios are intended to discourage VAPT engagements where VAPT is genuinely the right fit (Section 3.2 above). They are intended to help applicants who initially consider VAPT recognise when their actual need is certification instead — which is more common than the reverse mistake. When in doubt, the scoping conversation is the place to clarify; we will recommend certification over VAPT (or vice versa) based on your specific needs, even where the recommendation is for the higher-fee or longer-engagement option. The recommendation reflects what is appropriate for your need, not what is commercially preferable for Guardian.
Frequently Asked Questions
Common Questions, Answered
VAPT is a standalone technical service — independent vulnerability assessment and penetration testing producing a Technical Findings Report. Certification (Guardian SecureApp™) is an ISO/IEC 17065-accredited service producing an issued certificate, public directory listing, ongoing surveillance, and Mark Usage License. Both share the same evaluators, OWASP standards, and severity classification scheme. The difference is the procedural infrastructure that turns technical evaluation into procurement-grade attestation. VAPT serves technical-validation needs; certification serves procurement-grade-evidence needs.
No. Guardian Assessment Pvt. Ltd. holds UAF accreditation under ISO/IEC 17065:2012 (52605385601, valid until 05 May 2030) for the Guardian SecureApp™ product certification scheme. This accreditation does NOT extend to VAPT — VAPT is a non-accredited commercial service. Buyers comparing Guardian VAPT to other VAPT providers should evaluate on technical capability, evaluator quality, and methodology — accreditation does not differentiate VAPT engagements.
Not within 12 months. Per ISO/IEC 17065 Clause 4.2 (impartiality requirement), Guardian cannot accept an application for Guardian SecureApp™ certification of a product within 12 months of completing a VAPT engagement on the same product. The 12 months runs from the Technical Findings Report date (or final re-verification confirmation, whichever is later) to the certification application date. Most applicants who want pre-certification testing engage non-Guardian VAPT providers, then apply to Guardian for certification.
When your need is for technical security validation rather than procurement-grade attestation. Specific scenarios: pre-release product testing (no certification possible until release); internal security validation (third-party perspective without external attestation requirement); supplementary testing alongside non-Guardian certifications; one-off procurement requirements that accept VAPT reports rather than accredited certificates; routine periodic technical testing. If procurement requires accredited certification, regulatory frameworks reference 17065-accredited evidence, or you need public verifiability and ongoing surveillance, certification is the right path.
Substantively the same at the technical evaluation level — same evaluators, same OWASP standards (ASVS, Top 10, API Top 10), same severity classification scheme (Critical / High / Medium / Low / Informational), same finding-handling discipline. The differences are procedural: VAPT has lighter documentation review, no formal application review stage, no independent Decision Authority (because no certification decision is being made), and no certificate issuance. The technical depth at the matched depth tier (Focused / Standard / Comprehensive VAPT corresponding roughly to certification Levels 1 / 2 / 3) is comparable.
The cooling-off requirement exists to manage impartiality threats per ISO/IEC 17065 Clause 4.2. Even where the consultancy-adjacent service (VAPT) was conducted with rigorous separation — Guardian VAPT does not provide remediation guidance and does not advise beyond findings reporting — the structural relationship between provider and product creates an impartiality concern that procedural separation alone cannot fully resolve. The 12-month period allows the relationship between Guardian and the product to reset before certification can proceed without compromising the certification’s procurement-grade integrity.
The 12-month cooling-off rule precludes this for the same product. Where this scenario applies, you have several options: (1) skip Guardian VAPT and proceed directly to Guardian certification — certification’s Stage 4 Technical Evaluation provides substantively the same testing depth as VAPT; (2) engage non-Guardian VAPT for the pre-certification phase, then come to Guardian for certification; (3) defer the certification application to after the cooling-off period expires. The right option depends on your timeline and procurement-driver constraints.
Executive Summary; Engagement Overview (scope, methodology, timeline, evaluators); Findings Summary (severity-classified count, distribution across OWASP categories); Detailed Findings (the principal section, with per-finding ID, severity, affected component, description, reproduction steps, evidence, standards mapping including OWASP / CWE / MITRE references, and status); Methodology Appendix (testing tools, manual approach, OWASP standards versions); Limitations Appendix (out-of-scope items, time-constrained limitations, environment-specific factors). The report is delivered as a structured PDF document.
Bespoke per engagement. Indicative durations by depth tier: Focused VAPT typically 1–3 weeks; Standard VAPT typically 3–6 weeks; Comprehensive VAPT typically 6–12 weeks. End-to-end including initial enquiry, scoping, agreement, kickoff and delivery typically adds 3–4 weeks to testing duration. Combined-surface engagements (web app + API) and multi-product engagements run longer. Specific timing is confirmed in the Engagement Plan provided after scoping.
Scope-quoted only — there are no published starting figures for Guardian VAPT pricing. Tailored pricing for your specific engagement is provided in writing during scoping conversation. Scoping conversation is no-charge and no-commitment. Pricing reflects the bespoke scope, agreed depth tier, technology stack, and any specific applicant priorities. Initiate scoping at /quote with VAPT context flagged.
Re-verification is OPTIONAL in VAPT engagements (unlike certification, where one round is included as standard). Where applicants engage Guardian for re-verification, this is scoped and quoted as additional engagement effort. Many VAPT clients self-verify their own remediation rather than engaging Guardian for re-verification — the choice depends on internal capacity and external-validation requirements. If you want Guardian re-verification, request it in scoping conversation.
Yes — pre-release products are one of the principal scenarios where VAPT is appropriate. Certification is not available for pre-release products (Guardian SecureApp™ certifies released products at specific versions); VAPT is available for products at any state, including in development. Note the cooling-off implication: pre-release VAPT for a product that will subsequently be certified by Guardian creates the 12-month bar to that subsequent certification of the same product.
Yes. Guardian’s evaluators are protocol-experienced; OWASP API Security Top 10 (the principal API normative) is API-protocol-agnostic. Specific API protocols (REST, GraphQL, gRPC, SOAP, WebSocket) are scoped during scoping conversation, with the testing methodology adapted to each protocol’s specific risk patterns (GraphQL introspection and query complexity, gRPC schema and authentication, etc.).
No. Guardian VAPT is technical findings reporting; we do not provide remediation guidance as part of VAPT, just as we do not provide remediation guidance as part of certification. The boundary is the same: identify and document; do not advise. Where applicants need remediation guidance, that is appropriately engaged with independent security consultants or relies on internal engineering capability. The boundary protects the integrity of any subsequent certification engagement (after cooling-off) and reflects our consistent impartiality discipline across services.
Yes. The Technical Findings Report is delivered to the applicant as the engagement deliverable. The applicant owns the report and may share it with customers, auditors, regulators, or other parties at the applicant’s discretion under the Engagement Agreement’s confidentiality terms. Buyers and auditors reading a shared VAPT report should evaluate it on technical merit — VAPT does not carry procurement-grade attestation weight beyond what readers independently determine.
Initiate at /quote with VAPT selected as the service type, or contact Guardian via /contact with VAPT in the message subject. Initial Enquiry to scoping conversation typically runs 3–5 business days. The scoping conversation is no-charge and no-commitment; tailored pricing and engagement-specific details are provided after scoping.
Ready to Get Started?
Apply for Certification
Submit a formal application. Initial response within 5 working days.
Apply NowRequest a Quote
Tell us about your product. Indicative quote within 3 to 5 working days.
Get a QuoteTalk to Our Team
Specific question or regulatory driver to discuss?
Contact Us