VAPT means vulnerability assessment and penetration testing. The assessment finds weaknesses in the systems you point at. The penetration test tries to use those weaknesses the way an attacker would, to prove which ones are real. Startups ask for a VAPT cost because a customer, an investor or an app store has told them to "get a pentest" and the quotes they receive do not look comparable. The price moves with the size of the thing being tested, not with a flat fee for the word VAPT.
What you are buying
A useful test has a written scope, a test window, a list of accounts the tester may use, and a rule about what must not be broken. The output is a report your developers can act on: where the issue is, how it was reached, how serious it is, and what to change. A retest after the fixes is part of a serious engagement. A PDF of automated scan rows, with no one who tried to log in as another user, is not a penetration test. It is a scan, and it is cheaper because it skipped the work.
For a startup the valuable targets are usually small in number and high in impact. The public website, the API behind the app, the login and password reset, the payment path, and the admin panel. A test of "the whole cloud account and every microservice" is a different project. Buy the first. Add the second when the product and the budget are bigger.
What changes the cost
Count the applications, not the company. One web app with a handful of roles is a smaller test than three apps, a mobile client and a partner API. Authenticated testing costs more than a look at the login page, and it is the version that finds the issues that matter, because attackers log in too. A production test needs more care and sometimes a staging copy. A retest is a second pass over the fixes, not a free extra. Compliance mapping, if you need findings tied to OWASP, NIST or ISO 27001 for a questionnaire, is a writing task on top of the test.
Urgency costs money. A test squeezed into the week before a launch is staffed differently from one booked a month ahead. So does secrecy that blocks the tester from seeing how the app is supposed to work. The cheapest useful test is a scoped, authenticated test of one application, booked with enough time to fix what it finds before you invite the public.
How to compare two quotes
Ask each vendor the same questions. Which URLs and apps are included? Will they test logged-in roles, or only the marketing site? Is a retest included? Who writes the report, the person who did the test or a scanner? Will they stop if a check might knock the service over? A low quote that excludes authentication and a retest is not the same product as a higher quote that includes both. Compare those lines before you compare the number at the bottom.
Ask what happens to the findings. You want them in language a developer can reproduce, with a severity that reflects your business. A missing security header and a broken access control on customer records are not the same kind of problem, even if both are "vulnerabilities". A report that sorts them is worth more than a longer report that does not.
What to do with the result
Fix the issues an attacker would use first: account takeover, payment tampering, exposed admin functions, injection that reads other customers' data. Then retest those fixes. Then decide whether you need a recurring scan so the next deploy does not reopen the same door. Continuous scanning is a product decision. WhyXpose is the WarX tool for that ongoing view. The point test is still how you learn whether a person can chain the bugs a scanner only lists.
There is no honest single VAPT cost for "a startup". There is a cost for a defined application, tested with credentials, written up, and retested. If you can name that application, our VAPT and cybersecurity services can scope it. Bring the URL, the roles a user can have, and the date you need the report. That is enough to turn a vague security questionnaire into a test with a price.
If this is already happening to a title or a brand you represent, talk to our VAPT and cybersecurity services or Contact.