An enterprise client in Europe sends a security questionnaire to your organisation. Most questions are familiar: encryption at rest, access controls, and incident response procedures. Then one question stands out: “Was your most recent penetration test performed by a CREST-accredited provider?”

Your team already has a recent VAPT report with documented findings, verified remediation, and successful compliance reviews. However, a standard VAPT report may not meet a client’s specific requirement for CREST-accredited testing.

This situation is becoming increasingly common for Indian SaaS companies, fintech organisations, and IT service providers working with clients across the UK, Europe, Singapore, and Australia. This guide explains what CREST-accredited VAPT means, what the accreditation demonstrates, and when your organisation may need it.

In briefCREST-accredited VAPT is vulnerability assessment and penetration testing delivered by a company that CREST, an international not-for-profit accreditation body, has independently assessed for its testing methodology, quality processes, data handling, and staff competence. It is a procurement and assurance signal, not a regulatory licence. In India, it complements CERT-In empanelment rather than replacing it.

What is CREST?

CREST (Council of Registered Ethical Security Testers) is an international not-for-profit organisation that accredits cybersecurity service providers and certifies security professionals.

CREST assesses providers based on their processes, technical capabilities, security practices, and professional expertise. It also maintains a public directory of accredited cybersecurity companies.

CREST is not a government regulator and does not prescribe one standard testing method. Its accreditation provides assurance that a provider meets defined requirements for delivering specific cybersecurity services.

What “CREST-accredited VAPT” actually means

A VAPT engagement combines two activities. The vulnerability assessment identifies and prioritises known weaknesses across applications, networks, and cloud assets. The penetration test then attempts to exploit those weaknesses under controlled conditions to prove real business impact.

When that engagement is described as CREST-accredited VAPT, it means the provider delivering it has been assessed by CREST for the relevant service discipline, most commonly penetration testing. The accreditation covers how the firm scopes engagements, protects client data during testing, validates findings and removes false positives, quality-reviews reports before release, and handles complaints if something goes wrong.

Accredited members also sign an enforceable code of conduct and operate on an annual accreditation cycle, so the credential has to be maintained rather than earned once and displayed indefinitely.

Company Accreditation vs Certified Testers

A CREST certified tester is an individual who has passed a CREST examination and demonstrated the required technical skills.

A CREST-accredited company is an organisation whose processes, security practices, and service delivery CREST has assessed.

These are different. A company may have CREST-certified testers without being CREST accredited. If a client specifically requires CREST-accredited penetration testing, check that the service provider itself holds the required CREST accreditation.

What CREST assesses during accreditation

The accreditation process views the provider as a delivery organisation rather than a collection of tools. Assessors typically examine:

• Methodology: whether testing follows a documented, consistent approach for scoping, execution, and reporting
• Quality assurance: how findings are validated, how false positives are removed, and how reports are peer-reviewed before release
• Information security: how client data, credentials, and test evidence are stored, transmitted, and destroyed
• Competence: whether testers hold appropriate qualifications and whether skills are maintained over time
• Ethics and accountability: adherence to the CREST code of conduct and a formal complaints and resolution process

CREST has also introduced staged Pathway programmes for organisations working towards full accreditation, and in July 2026 it added an optional AI-enabled penetration testing module for providers that formally integrate AI into their testing workflow. Neither of these should be confused with full accreditation for a given service, which is why verification matters.

Why CREST Accreditation Matters

CREST accreditation gives buyers an independent way to assess a cybersecurity service provider’s credibility and capability. It provides assurance that the provider follows defined processes and meets recognised requirements for its accredited services.

Builds Client Trust

CREST accreditation gives procurement, security, and risk teams an independent reference when evaluating penetration testing providers. This can make it easier to assess a provider’s capabilities and security practices.

Supports International Business

Many large enterprises and organisations in the UK and other international markets include CREST requirements in their supplier or security assessments. CREST-accredited testing can help organisations meet these requirements and avoid procurement delays.

Promotes Structured Testing

Accredited providers follow assessed processes for delivering their services. This supports structured scoping, manual testing, proper vulnerability validation, and clear reporting that can help technical teams prioritise remediation.

Provides Greater Assurance

CREST accreditation does not guarantee that every vulnerability will be identified. However, it provides assurance that the provider has been assessed against defined requirements. The final quality still depends on scope, tester expertise, and effective remediation.

CREST and CERT-In: How They Fit Together in India

For Indian organisations, CERT-In empanelment and CREST accreditation serve different purposes. Understanding the difference can help you choose the right security testing provider for your regulatory and business requirements.

Consideration	CERT-In Empanelment	CREST Accreditation
Issued by	Government of India through MeitY	International not-for-profit organisation
Primary focus	Indian regulatory and government requirements	International client and procurement requirements
Common requirement	RBI, SEBI, IRDAI, and government audits	Overseas clients, contracts, and security questionnaires
Focuses on	Auditing organisation, personnel, and processes	Service quality, processes, and tester competence
Best suited for	Organisations operating under Indian regulatory requirements	Organisations serving international markets

In simple terms, CERT-In empanelment is often important for Indian regulatory requirements, while CREST accreditation can help meet international client expectations. Some organisations may require both, depending on their customers and compliance obligations.

For a clearer understanding of the domestic requirements, explore our guide on RBI and SEBI requirements for vulnerability management in India.

When Your Organisation Actually Needs CREST-Accredited VAPT

CREST is not a legal requirement in India. Whether you need it depends on who will rely on the report. In practice, the following situations make it relevant:

• An international client, partner, or regulator explicitly requests testing by a CREST-accredited provider
• A contract or master services agreement names CREST as a supplier requirement
• Your organisation operates in, or sells to, markets where CREST is embedded in regulatory or government frameworks
• Your third-party risk programme requires independent quality evidence for critical security service vendors

If the test is purely for internal security improvement, or for an Indian regulatory submission where CERT-In empanelment is the expected standard, a rigorous non-CREST engagement from a credible empanelled provider can be entirely appropriate. The decision should follow the evidence requirement, not the logo.

How to verify a provider’s CREST status

Vendor websites are not evidence. Before awarding an engagement, a sensible verification routine looks like this:

• Search the provider’s legal entity name in the official CREST member directory and confirm the listing is current
• Check which specific service the accreditation covers, since penetration testing accreditation does not automatically extend to every other service the firm sells
• Confirm that the entity delivering your engagement is the accredited entity, particularly where groups operate several subsidiaries across countries
• Ask which testers will be assigned, and what individual certifications they hold
• For Indian regulatory use, separately confirm CERT-In empanelment against the official list

This takes less than an hour and prevents a far more expensive problem later. It also fits naturally into a broader vendor risk management process for security service providers.

Questions worth asking any VAPT provider

Accreditation is a starting point, not the whole evaluation. Whether or not a provider is CREST-accredited, the following questions reveal how an engagement will actually be delivered:

• How much of the testing is manual, and how are automated findings validated?
• Does the scope include business logic and authorisation testing, or only known vulnerability classes?
• Is retesting after remediation included in the engagement?
• Can you share a sanitised sample report?
• How are findings mapped to the frameworks we report against, such as ISO 27001, PCI DSS, or RBI guidelines?

A provider that answers these clearly usually produces reports that stand up to scrutiny. A deeper look at how a refined VAPT process is structured helps teams recognise what good looks like.

How CyRAACS Supports VAPT Requirements

Understanding the right accreditation is only one part of the decision. The next step is choosing a provider that can meet your regulatory, technical, and client-specific testing requirements.

• CERT-In Empanelled Since 2017: CyRAACS has been CERT-In empanelled since 2017, supporting VAPT requirements for regulated and enterprise organisations in India.
• Testing Across Key Environments: Our VAPT services cover web applications, mobile applications, APIs, networks, and cloud environments across banking, fintech, healthcare, technology, and other sectors.
• Support for International Requirements: For organisations working with international clients, we help define the appropriate scope, methodology, and reporting requirements before testing begins.
• Clear and Actionable Reporting: Our reports provide documented findings, evidence, risk ratings, and remediation guidance to support technical teams, auditors, regulators, and client security reviews.

Explore our VAPT services to learn more about our testing capabilities and methodology. For organisations requiring regular security assessments, explore our managed VAPT services.

Frequently asked questions

Is CREST accreditation mandatory for VAPT in India? 

No. Indian regulators generally reference CERT-In empanelment. CREST becomes relevant when international clients, contracts, or overseas frameworks require it.

Does a CREST certified tester make a company CREST accredited? 

No. Individual certification and company accreditation are separate. Buyers asking for CREST-accredited penetration testing are usually asking about the organisation.

How long does CREST accreditation last? 

Accreditation runs on an annual cycle with ongoing obligations, so always verify status against the current directory rather than a past certificate.

Does CREST accredited VAPT guarantee my systems are secure? 

No credential can guarantee that. It indicates that the provider operates to independently assessed standards. The outcome still depends on scope, testing depth, and remediation.