VAPT stands for Vulnerability Assessment and Penetration Testing. It is two different jobs in one word. The first finds possible security holes, and the second proves which of them are real, with written permission.
It is easy to learn only the first half. You run a scanner, export a long list, and call it a VAPT report. Employers who hire for VAPT want the second half too. So it helps to know the difference before you pick any cybersecurity training in Nepal.
What does VAPT stand for?
Vulnerability assessment is the wide, fast part. You look at a website, a server or an app and list every weakness it might have. Much of this work is done with scanners such as Nessus, OpenVAS or nuclei. The result is a list of possible problems, and some of them are false alarms.
Penetration testing is the narrow, slow part. You take items from that list and try to use them, the way an attacker would, inside an agreed scope. The UK's National Cyber Security Centre describes a penetration test as trying to break a system's security with the same tools and techniques an attacker might use. The result is proof. This bug is real, this is what an attacker could do with it, and this is how to fix it.
A short way to remember it: the assessment asks what might be wrong. The test asks what is really wrong, and how bad it is.
Where does VAPT show up in Nepal job posts?
Payment and finance companies in Nepal use the word in their job posts. A 2025 eSewa post asked for someone "proficient in conducting VAPT for hosts, web applications, network devices, APIs, and mobile applications". A VAPT Security Engineer post from PaaSPay on merojob listed Burp Suite, Nessus, Metasploit and Nmap, plus strong report writing.
Both posts were for people with years of experience. Still, they show what the job looks like when you get there. Notice that both ask for reports, not only tools. The report is the thing the client pays for.
Is running a scanner the same as VAPT?
No. The OWASP Web Security Testing Guide, a free guide from the OWASP security community, is direct about this. It says automated tools "do not think creatively". It calls web scanners useful "as a first pass to find low-hanging fruit". It also tells testers to remove false positives before a report goes out.
So a VAPT report full of unchecked scanner output is worse than a short one. The client's developers spend days on problems that were never there. A good tester sends fewer findings, and every finding has steps to reproduce it.
Our view is simple. Learn to find bugs by hand first, and add scanners later. You can only judge a scanner's finding after you have found that kind of bug yourself.
What does a junior VAPT analyst do all day?
Mostly web apps and APIs. An API is the hidden connection apps use to send data. A junior gets a written scope that says exactly what may be tested. They test the site through a proxy tool like Burp Suite, and they save every request and screenshot as they go. They check scanner results by hand. Then they write.
The NCSC says a test report should list each issue, its risk and a way to fix it. That writing takes real time, so practise it from your first lab.
Permission matters more than any tool. In Nepal, testing a system without written permission is a crime under the Electronic Transactions Act 2063, Sections 45 and 46. Practise only on targets that are built for it.
How long does it take to learn VAPT in Nepal?
There is no fixed answer, but the order is fixed. You need networks, Linux and how the web works before any of this makes sense. Without them, Burp Suite is a screen full of requests you cannot read.
At Saarathi Academy in Old Baneshwor, Kathmandu, the Cybersecurity and Ethical Hacking course runs 12 weeks, two hours a day, Monday to Friday. Weeks 1 to 4 cover the terminal, networks, recon and Linux. Weeks 6 to 8 are spent testing websites and APIs by hand in Burp Suite, on the free PortSwigger labs. Scanners like nuclei come in Week 9, and every scanner result must be checked by hand before it counts. In Week 11 you test inside a written scope and write a full VAPT report.
The course trains for two junior jobs. One is web and API VAPT analyst. The other is Tier-1 SOC analyst, the person who watches a company's security alerts. Each batch has up to 10 students in the classroom.
What can you try tonight, for free?
Open the PortSwigger Web Security Academy. It is free, and its SQL injection topic alone has 16 labs. The labs run on PortSwigger's servers, so an old laptop is enough. Install Burp Suite Community Edition, which is also free, and solve the first lab.
Then write three lines. What did you do? What does it prove? How would the developer fix it? That is a small VAPT finding, and it is the habit the whole job is built on.
If you want to see how testers plan a full test, read the introduction of the free OWASP Web Security Testing Guide.
Every week's topics are in the course syllabus, and the rest is on the course page.
Top comments (0)