Your ICT Platform Serves Many Customers. Does Your VAPT Scope Reflect That?

An ICT company may test its public website and still miss the risks that matter most to customers: tenant isolation, API authorisation, cloud identity paths and administrative access. VAPT in cyber security should be scoped around the way your platform actually delivers services, not around a generic checklist of servers and websites.

For ICT providers offering managed platforms, SaaS, connectivity, data services or multi-tenant applications, customer security reviews usually focus on one question: can one customer’s data, workload or configuration affect another? A VAPT programme should be able to answer that clearly.

What Should VAPT Cover in an ICT Environment?

An ICT attack surface extends beyond customer-facing applications. It includes the identities, workloads, integrations and administrative paths that connect customer data to your infrastructure.

VAPT in cyber security for an ICT company should typically cover:

• Customer portals, web applications and mobile applications.
• Public, partner and internal APIs.
• Cloud environments, including identities, storage, serverless and network controls.
• Containers, image registries, Kubernetes controls and deployment pipelines.
• Multi-tenant isolation, role boundaries and customer data separation.
• Administrative interfaces, support tools and internal management systems.
• Third-party integrations that handle customer data or platform operations.
• External and internal network segmentation, remote access and privileged accounts.

A narrow scope may produce a report, but it may not provide the assurance your customers need.

How Is ICT VAPT Different From General IT VAPT?

General IT VAPT often focuses on corporate systems, endpoints and internal networks. ICT VAPT must also assess the platform you sell to customers.

This difference affects scope, test cases, evidence and reporting. A provider that treats an ICT platform like an internal corporate network may miss the risks customers care about most.

What Should a VAPT Service Provider Ask Before Quoting?

A capable VAPT service provider should ask detailed questions before proposing an engagement. If the conversation begins and ends with the number of IP addresses, the scope is likely too narrow.

Expect questions such as:

• Which applications, APIs, cloud accounts and environments are in scope?
• How is tenant isolation implemented across data, compute and identity layers?
• Which roles can access customer data, deployments or administrative functions?
• Are there separate test environments, and how closely do they resemble production?
• Which third-party services exchange customer data with the platform?
• What compliance or customer-review requirements must the report support?
• Are there systems that cannot be tested in production, and what alternatives exist?
• Who will receive findings, assign remediation and approve retesting?

These questions help align the assessment with real business risk rather than a generic technical checklist.

What Do Testers Commonly Examine in Multi-Tenant Platforms?

In multi-tenant ICT platforms, testers often focus on boundaries. The objective is to determine whether controls hold when a user, token or workload attempts to cross them.

Common areas include:

• Whether one customer can view, modify or delete another customer’s records.
• Whether API identifiers, tenant identifiers or object references can be manipulated.
• Whether shared services properly separate customer data and configuration.
• Whether administrative roles can access data beyond their intended customer or region.
• Whether container workloads, serverless functions or scheduled jobs can access more data than required.
• Whether cloud roles can be assumed by a compromised workload or deployment pipeline.
• Whether logs, backups, exports or support tools expose data across tenants.

These checks require manual validation. Automated tools can identify misconfigurations, but they cannot always understand tenant context or business logic.

A Multi-Tenant VAPT Scope Checklist

Before engaging a provider, confirm that the scope addresses the following:

• Customer-facing web and mobile applications.
• Public, partner and internal APIs.
• Cloud accounts, regions, identities and network controls.
• Containers, serverless functions, databases and storage.
• Tenant isolation at data, application and identity layers.
• Administrative, support and internal management interfaces.
• CI/CD pipelines, deployment credentials and container registries.
• Third-party integrations and data-sharing flows.
• Logging, monitoring and alerting for cross-tenant or privileged activity.
• Retesting arrangements for high and critical findings.

If any area is missing, ask whether it is excluded deliberately and why.

Red Flags When Reviewing a VAPT Proposal

Some proposals look comprehensive but provide limited assurance.

• The scope is defined only by IP addresses or a single website.
• Tenant isolation is not mentioned, even though the platform serves multiple customers.
• The provider promises a report without discussing access, environments or rules of engagement.
• Testing is described as fully automated, with no manual validation.
• The proposal does not clarify how production data will be protected.
• Retesting is absent, vague or not linked to validated findings.
• The provider cannot explain how findings will be prioritised or remediated.
• The report is promised as proof of compliance, rather than as security-testing evidence.

A credible provider will be transparent about what it can test, what it cannot test and what evidence it will deliver.

How Often Should ICT Companies Conduct VAPT?

ICT platforms change frequently. New APIs, customer features, cloud services and integrations can introduce new exposure between annual assessments.

A practical cadence includes:

• Full VAPT annually for critical platform components.
• Targeted testing after major API, cloud, container or tenant-isolation changes.
• Continuous vulnerability scanning and configuration monitoring.
• PTaaS for recurring scans, dashboards, issue tracking and retesting.
• Updated assurance evidence before major customer onboarding or audits.

IBN Technologies provides VAPT services for ICT companies from India, with an office in Pune. Its engagements cover web, API, mobile, cloud, container and network testing, with manual validation, CVSS-based reporting, remediation support, retesting and optional PTaaS.

Frequently Asked Questions

Should VAPT include tenant isolation testing for an ICT platform?
Yes, where the platform serves multiple customers. Tenant isolation testing examines whether one customer can access another customer’s data, configuration or workload. It should cover APIs, identity boundaries, shared services, administrative access and cloud permissions.

Can VAPT be performed without access to production environments?
Yes, but the report’s assurance value depends on how closely the test environment resembles production. If production testing is not possible, the provider should test equivalent staging environments, review configurations and clearly document any limitations in the final report.

How often should an ICT company conduct VAPT?
A full assessment is sensible annually and after major changes to APIs, cloud architecture, containers or tenant isolation. Companies that release frequently can use PTaaS for recurring scans, issue tracking and retesting between full assessments.

For ICT companies that need multi-tenant, cloud and API-focused VAPT, IBN Technologies provides VAPT, remediation support, retesting and PTaaS from India.

Contact Us
IBN Technologies
Phone: +91 20 6768 0404
Email: sales@ibntech.com