Start a brief Brief

Menu

Start a brief

Vulnerability scan vs penetration test: stop buying the wrong one

One enumerates known weaknesses. The other tries to prove impact. Mixing the labels is how budgets disappear.

By Halil Ahmad · Founder 7 min read

A vulnerability scan finds known issues with signatures and checks. A penetration test attempts to exploit and chain weaknesses the way an attacker would. If you need prioritised, reproducible impact against your environment, you need a test, not a renamed scan.

What a scan actually does

A vulnerability scanner asks a large set of known questions: Is this service outdated? Does this header look weak? Does this path match a signature? It is fast, repeatable, and useful when you run it often enough to catch drift.

It is also blunt. It does not understand that the “critical” finding sits behind a network control you already trust, or that the medium finding on the payment callback is the one that would hurt. It ranks by a generic score, not by your business.

Treat scan output as a queue for triage, not as a to-do list printed in severity order.

What a test adds

A penetration test starts from the same surface, then tries to move. Can this issue become a session? Can two lows become a high? Does the staging misconfiguration unlock production data?

That work needs time, judgement, and a written scope. You are paying for someone to think adversarially inside your constraints, not for another CSV of CVEs.

Good tests also say what they could not prove. “We could not escalate from here” is a finding about residual risk, not a failure of the tester.

Where vendors blur the line

The market loves to sell scans as tests. Watch for proposals that promise “penetration testing” and deliver authenticated scanning plus a cover page. Watch for day rates that only make sense if nobody is doing manual chaining.

Ask what happens after the tool finishes. If the answer is “we validate the highs”, you are still buying a scan with a human QA pass. Validation is not exploitation.

Also ask for a sample report with reproduction steps. If the sample is screenshots of scanner UI, believe the sample.

How to choose without theatre

Buy continuous scanning for coverage and regression. Buy a penetration test when you need confidence about impact: a release, a customer questionnaire, a merger, a new attack surface.

If budget only allows one this quarter, pick based on the decision you have to make. “Are we broadly untidy?” is a scan question. “Can someone reach customer data from the public edge?” is a test question.

Renaming one as the other does not change what you received. It only changes how embarrassed you are when the next assessor asks for the raw method.

Questions

Is an authenticated scan the same as a penetration test?

No. Credentials improve coverage of what the scanner can see. They do not replace human chaining, business-logic abuse, or judgement about what matters in your stack.

Do we still need scans if we pen test annually?

Yes. Scans are continuous hygiene. Tests are deeper, slower, and usually periodic. They answer different questions.

Why do scan reports feel so long?

Because scanners optimise for coverage and known signatures, not for what is exploitable in your deployment. Length is not prioritisation.

Let's Talk.

Five questions, about two minutes. A named person replies within one working day.

Start a brief