EquiView Blog
Accessibility Audit vs VAPT: What's the Difference and Do You Need Both?
Quick answer: An accessibility audit checks whether a website or app can be used by people with disabilities (screen readers, keyboard navigation, contrast, etc.) and is required under SEBI's WCAG 2.2 mandate. VAPT (Vulnerability Assessment and Penetration Testing) checks whether a system is secure from hackers and is required under SEBI's cybersecurity framework. They test entirely different things, are governed by different circulars, and most SEBI-registered entities need both — but they can be scoped and scheduled separately to control cost.
If your compliance team has been asked to “get an audit done” and you're not sure whether that means an accessibility audit, a VAPT, or both, this guide breaks down exactly where the two overlap, where they don't, and how to plan for each.
Why This Question Comes Up So Often
Stock brokers, AMCs, depositories, and other SEBI-registered intermediaries are juggling two separate but simultaneous regulatory tracks in 2025–2026:
- SEBI's cybersecurity and cyber resilience framework (CSCRF), which has required periodic VAPT for years.
- SEBI's digital accessibility circular, which now requires WCAG 2.2-aligned audits by IAAP-certified professionals.
Because both are “SEBI-mandated audits” that get commissioned around the same time, IT and compliance teams often assume one vendor or one report can cover both. It can't. Here's why.
What an Accessibility Audit Actually Tests
An accessibility audit evaluates whether your website, trading platform, or mobile app can be used by people with disabilities — including those who are blind, low-vision, deaf, or have motor or cognitive impairments.
A proper accessibility audit typically covers:
- Screen reader compatibility — can a NVDA, JAWS, or VoiceOver user navigate account opening, trading, and statements?
- Keyboard-only navigation — can every action be completed without a mouse?
- Color contrast and visual design — do text and UI elements meet WCAG 2.2 AA contrast ratios?
- Form labels and error handling — are input fields, OTP screens, and validation messages announced correctly?
- Document accessibility — are contract notes, statements, and disclosures available as tagged, screen-reader-friendly PDFs?
- Dynamic content — are live stock tickers, charts, and alerts perceivable by assistive technology?
The output is a WCAG 2.2 conformance report, an issue log mapped to specific success criteria, and a remediation roadmap — the documentation SEBI expects intermediaries to hold on file and reference in their Annexure B submissions.
What VAPT Actually Tests
VAPT stands for Vulnerability Assessment and Penetration Testing. It has nothing to do with usability or disability access — it's a security exercise designed to find ways an attacker could compromise your systems.
A VAPT engagement typically covers:
- Network and infrastructure vulnerabilities — open ports, outdated software, misconfigured servers.
- Application-layer flaws — SQL injection, cross-site scripting (XSS), broken authentication, insecure APIs.
- Penetration testing — ethical hackers actively attempting to breach the system the way a real attacker would.
- Data protection gaps — encryption weaknesses, insecure data storage, session management issues.
The output is a vulnerability report ranked by severity (critical, high, medium, low) with remediation steps, usually followed by a re-test to confirm fixes.
Accessibility Audit vs VAPT: Side-by-Side Comparison
| Accessibility Audit | VAPT | |
|---|---|---|
| Tests for | Usability for people with disabilities | Security vulnerabilities and exploits |
| Standard applied | WCAG 2.2 Level AA | OWASP, CERT-In guidelines |
| Regulatory basis | SEBI's digital accessibility circular | SEBI's Cybersecurity and Cyber Resilience Framework (CSCRF) |
| Who performs it | IAAP-certified accessibility professionals | Certified ethical hackers / CERT-In empanelled auditors |
| Tools used | Screen readers, contrast checkers, keyboard testing, axe/WAVE | Nessus, Burp Suite, manual penetration testing tools |
| Typical output | WCAG conformance report + remediation roadmap | Vulnerability report + severity ranking + re-test |
| Frequency required | Periodic, tied to major platform changes and SEBI timelines | Typically annual or half-yearly under CSCRF |
| Overlap with the other | None on methodology; some overlap on "who owns the finding" for broken forms | None |
So Do You Need Both?
Yes — if you're a SEBI-registered intermediary with an investor-facing website, trading platform, or mobile app, you're very likely already required to do VAPT under the cybersecurity framework, and now also required to complete a WCAG 2.2 accessibility audit under the separate accessibility circular. One does not substitute for the other, and a security-only “compliance audit” will not satisfy SEBI's accessibility documentation requirements — auditors reviewing your Annexure B submission will specifically look for IAAP-certified accessibility sign-off, not a penetration test report.
The confusion mostly comes from the word “audit” being used loosely by vendors and internal teams for both. When someone says “we need a compliance audit,” it's worth asking immediately: audit of what — security, or accessibility?
Can One Vendor Do Both?
Some larger firms offer both services, but they're delivered by different specialists internally — a penetration tester and an accessibility auditor are not interchangeable skill sets, the same way a fire safety inspector isn't a structural engineer. If a vendor offers both, ask to see:
- The IAAP certification of the person(s) performing the accessibility work.
- The CERT-In empanelment or equivalent security credentials of the person(s) performing VAPT.
If a single generalist “IT auditor” is signing off on both, that's a red flag — see our buyer's checklist for IAAP-certified auditors for what to verify before engaging anyone.
How to Sequence and Budget for Both
For most stock brokers, AMCs, and DPs working through 2026 deadlines, this order tends to work best:
- Run your accessibility audit first if your compliance deadline is closer, since WCAG remediation (contrast, labels, keyboard traps, PDF tagging) usually takes longer to fix than typical VAPT findings.
- Keep VAPT on its existing annual/half-yearly cycle under CSCRF — don't let accessibility work delay a security testing cycle you're already obligated to run.
- Budget them as separate line items. Combining them into one vague “compliance audit” budget line makes it hard to track scope, and vendors will price them differently — accessibility audits are typically scoped by number of user flows and platforms tested, while VAPT is scoped by number of applications, endpoints, and IPs.
- Re-test after remediation, for both. An accessibility audit isn't done until the fixes are verified against WCAG 2.2 success criteria; a VAPT isn't done until a re-test confirms vulnerabilities are closed.
For a full breakdown of the accessibility side specifically — deadlines, affected entities, and documentation — see our SEBI digital accessibility mandate guide and the stockbroker compliance checklist.
Frequently Asked Questions
Is VAPT a substitute for a SEBI accessibility audit?
No. VAPT tests security, not usability for people with disabilities. SEBI's accessibility circular specifically requires a WCAG 2.2 audit performed by an IAAP-certified professional — a VAPT report will not satisfy this requirement.
Is an accessibility audit a substitute for VAPT?
No. An accessibility audit doesn't test for security vulnerabilities like SQL injection or broken authentication. If you're required to run VAPT under SEBI's cybersecurity framework, an accessibility audit doesn't cover that obligation.
Do small stockbrokers or IAs need both?
If you're a SEBI-registered entity with an investor-facing digital platform, both obligations generally apply to you, regardless of size — though the scope and depth of each engagement can be tailored to your platform's complexity.
Which one should I do first if I have a tight budget?
Prioritize whichever has the nearer regulatory deadline for your entity category. If both are due around the same time, accessibility remediation typically takes longer to implement, so starting that audit earlier gives your team more runway to fix issues before submission.
Can the same report cover both accessibility and security findings?
Some vendors bundle findings into one combined "compliance report" for convenience, but the underlying testing methodologies, standards, and certifications are separate. What matters for SEBI compliance is that each domain is signed off by the appropriately certified professional.
Need a WCAG 2.2 accessibility audit for your SEBI compliance filing? See EquiView's audit process and pricing.