Penetration Testing Hub › Penetration Testing Explained
Penetration Test vs Vulnerability Scan: Which Do You Need?
This is an explainer rather than a how-to, but the site's rule holds throughout: only test systems you own or are explicitly authorised to test, under the Criminal Justice (Offences Relating to Information Systems) Act 2017.
These two get sold as if they're the same thing, or as if one is just a cheaper version of the other. They're not. They answer different questions, and buying the wrong one wastes money either way.
The short version
A vulnerability scan is an automated tool listing known weaknesses. A penetration test is a person safely exploiting and chaining those weaknesses to show real-world impact. The scan tells you what might be wrong; the test tells you what an attacker could actually do about it.
Vulnerability scanning, honestly
A scanner (Nessus, OpenVAS, Qualys and the like) compares your systems against a database of known issues and produces a rated list. Its strengths: it's fast, cheap, repeatable, and easy to run on a schedule. Its weaknesses: it reports in isolation — every finding stands alone, with no sense of which ones chain into a real breach — and it produces false positives you have to triage.
Run scans often. They're how you catch the new critical vulnerability three days after it's disclosed, not three months later at your annual test. For a lot of organisations, a good scanning-and-patching habit is the single highest-value security control they don't yet have.
Penetration testing, honestly
A pentest is manual and adversarial. A human takes what the scan (and their own reconnaissance) found and asks the questions a tool can't: can I actually use this? Can I combine it with that? Where does it get me, and what's the business impact when I arrive? The output isn't a count of CVEs — it's 'from the guest Wi-Fi I reached your payroll data, here's every step, here's how to close it'.
That depth costs time and expertise, which is why a test costs more than a scan and why it's wasted if the scan-level basics aren't fixed first.
Which one, when
Start with scanning if…
- You've never scanned before.
- You know you have unpatched systems and haven't worked through them.
- You need continuous, low-cost visibility of new vulnerabilities.
- Budget is tight and the basics aren't done.
Move to a pentest when…
- You've fixed what scanning found and want to know what's left.
- You handle sensitive data or take payments.
- A framework (NIS2, PCI DSS, DORA) or customer requires an actual test.
- You've shipped something new and exposed and need to know its real risk.
- You need evidence of business impact to justify security spend to a board.
The trap to avoid
Some vendors sell an automated scan with a nicer PDF and call it a penetration test. If no human ever tried to exploit or chain anything, you had a scan. Ask directly: will a person manually attempt exploitation, and will the report show attack chains, not just a vulnerability list? If the answer is vague, so is the test.
You'll likely want both
The mature pattern isn't either/or. It's continuous scanning to catch new issues fast, plus a periodic penetration test to find what scanning can't see — the logic flaws, the chained paths, the misconfigurations that only matter in combination. Scanning is the smoke alarm; the pentest is the fire drill.
Common questions
Is a vulnerability scan the same as a penetration test?
No. A vulnerability scan is an automated tool that lists known weaknesses; a penetration test is a human safely exploiting and chaining those weaknesses to demonstrate real business impact. The scan says what might be wrong, the test shows what an attacker could actually do.
Which is cheaper, a scan or a pentest?
A vulnerability scan is far cheaper and can be run continuously; a penetration test costs more because it's skilled manual work. For many organisations the right sequence is to scan and patch first, then invest in a pentest once the obvious issues are gone.
Can a vulnerability scan replace a penetration test for compliance?
Sometimes for lighter requirements, but frameworks like PCI DSS 11.4 and DORA specifically require penetration testing, not just scanning. Check the exact wording of the framework that applies to you — a scan alone usually won't satisfy a requirement that names a penetration test.
Not sure whether you need a scan, a test, or both? We'll give you a straight answer for your situation — here's how that conversation works with CyberLabs.
No prices on this page and no hard sell.
This page is educational and not legal advice. Only test systems you own or are explicitly authorised to test. · ↑ Back to top