VAPT is carried out to find as many vulnerabilities and configuration issues as possible in the time allotted and exploiting those vulnerabilities to determine the risk of the vulnerability. Vulnerability Assessments and Penetration Tests are designed to find vulnerabilities and assess to ensure they are not false positives.