Vulnerability Assessment & Penetration Testing
We scan applications, infrastructure and configuration for known weaknesses, test, within an agreed written scope, what an attacker could reach, then give you a remediation plan ordered by exposure and retest each finding once it is fixed.
Vulnerability assessment and penetration testing (VAPT) means scanning your systems for known weaknesses, then testing within an agreed scope which of them an attacker could use and what they would reach.
It suits IT and security teams that need an outside check of their exposure, whether the system was built in-house or by another vendor.
Is this the right fit?
You may need this if
A launch, tender or audit is near
You need to know what an attacker could reach before the system goes live or is audited.
Past scans gave an unsorted list
The report lists findings by severity label, with false positives mixed in and no fixing order.
The system changed after its last test
New features, integrations or a cloud move have gone live since anyone last checked the exposure.
Fixes were never checked
Tickets are closed, but nobody has checked that the fixes work.
What we deliver
Vulnerability scanning
Scans across applications, infrastructure and configuration, with false positives removed before the findings reach you.
Controlled penetration testing
Testing which findings an attacker could use, within a written scope and rules of engagement agreed beforehand.
Web and API testing
Sign-in, permissions, injection, business-logic flaws, and interfaces that were never meant to be reachable from outside.
Remediation plan
Findings ordered by exposure and grouped by root cause, each with what fixing it involves.
Retest of fixed findings
After your team's fixes, we test each finding again and check that no new issue was introduced.
How we work
Every engagement runs through the same six-stage fitting process, from the first consultation to long-term care. The stages stay in the same order; how deep each one goes depends on the project.
See the full fitting process- ConsultationDiscover
- MeasureAnalyze and architect
- PatternDesign
- FittingBuild with you
- FinishingHarden and launch
- AftercareMaintain and support
What a VAPT engagement covers
Before any testing we agree the scope in writing: which applications, APIs, servers and environments are included, which are excluded, the testing windows, and who to call if something has to stop.
Scanning comes first, and we remove false positives before anything reaches your team. Controlled testing then confirms which findings can be exploited and what they expose. The remediation plan groups findings by root cause, so one fix to a shared sign-in pattern can close several of them. We walk your developers and system owners through the plan, and when they report a finding fixed, we retest it and update its status.
MERCIL is not an accredited testing body, and our report is not a formal attestation. Where a regulator, auditor or tender requires an attestation from an accredited firm, we work alongside one, or you can engage one directly.
Organizations we work with
Engagements span build, integration and long-term support. Named with permission; clients under NDA are not listed.
Related services
- Application Security: to prevent weaknesses during design and development.
- Software Testing & QA: when the concern is functional defects.
- Cloud Migration & Architecture: when the exposure comes from cloud configuration.
- Maintenance & Support: for a team to fix the findings and keep the system patched.
Frequently asked questions
How much does VAPT cost?
It depends on the number of applications, APIs and servers in scope, how many user roles we test with, how many environments are included, and whether you want a retest after remediation. We send a written estimate after a short scoping call. Public-sector work is estimated against the TOR.
Are you an accredited penetration testing provider?
No. MERCIL is not an accredited testing body, and our report is not a formal attestation. Where a regulator, auditor or tender requires an attestation from an accredited firm, we work alongside one, or you can engage one directly.
Will testing disrupt our production systems?
Destructive techniques are excluded unless agreed in writing, testing windows are set in advance, and you have a contact who can stop the test at any point. Where testing production carries too much risk, we test a staging environment and state in the report what that leaves untested.
How often should we run an assessment?
A test describes the system on the day it ran, and anything released afterwards is untested. Run one before a major launch and after large changes, such as a new integration or a cloud move. Between tests, dependency scanning, pipeline security checks and monitoring cover the gap.
Can you test a system MERCIL built for us?
Yes, as an internal check before launch. Where the assessment has to be shown to be independent, for example for a regulator, a tender or your board, we say so during scoping and suggest a provider that had no part in building the system.
Next step
Start with a conversation
Tell us about the problem you are trying to solve. A senior person reads every inquiry and replies with our view of fit, scope and cost, including when another option would suit you better.