Vulnerability scan vs penetration test: what’s the difference?

The short version:

• A scan is automated, broad and frequent; a penetration test is manual, deep and periodic.
• Scans answer "what known weaknesses exist?"; tests answer "what could an attacker actually achieve?"
• Most clients need regular scanning all year and a penetration test annually or after major change.

Two different questions

A vulnerability scan uses an automated tool such as Nessus, Greenbone / OpenVAS, Qualys or Rapid7 to check systems against a database of known vulnerabilities and misconfigurations. It is broad, repeatable and cheap enough to run every month.

A penetration test is a time-boxed engagement in which a skilled tester tries to break in, chaining weaknesses together the way a real attacker would, and documents what they reached. It is deep, creative and expensive enough that most organizations do it once a year or after a major change.

Side by side

Vulnerability scan compared with a penetration test

• Performed by: Automated tool, configured by a technician; Skilled human tester
• Typical frequency: Monthly or more; Annually or after major change
• Coverage: Every host in scope; Chosen targets and attack paths
• Finds: Known vulnerabilities and misconfigurations; Exploitable paths, business logic flaws, chained weaknesses
• Proves exploitation: No; Yes, within the agreed rules of engagement
• Output: List of findings to remediate; Narrative of what was achieved, with findings

Which does a client need?

• Ongoing hygiene: regular vulnerability scanning with remediation tracking. This is the core of a managed security service.
• Compliance: PCI DSS requires both quarterly scans and an annual penetration test; many other frameworks and customers ask for a penetration test periodically.
• Before a big change or after an incident: a penetration test of the affected environment.
• Cyber insurance: applications commonly ask about scanning and patching; some ask about penetration testing for larger policies.

A penetration test on an environment that is not scanned and patched regularly mostly finds the missing patches a scan would have found. Do the scanning first; the test is then worth more.

Explaining it to a client

An analogy that works: a vulnerability scan is checking every door and window in the building to see which are unlocked. A penetration test is hiring someone to try to get to the safe. You want the first done every month and the second once a year.

Varaxon Scan Hub is a reporting tool for the first: it turns the scanner's export into a prioritized, plain-language remediation report. It does not perform penetration tests or claim an environment is secure. See what a vulnerability assessment report should include.

Common questions

Can a vulnerability scan replace a penetration test for PCI DSS?

No. PCI DSS v4 requires both: vulnerability scans at least every three months (requirement 11.3) and penetration testing at least once every twelve months and after significant changes (requirement 11.4).

Is a vulnerability assessment the same as a vulnerability scan?

The terms are often used interchangeably. Strictly, the scan is the automated check, and the assessment includes reviewing the results, prioritizing them and recommending fixes, which is what the report delivers.

This guide first appeared on varaxontech.com.

I'm building Varaxon Scan Hub. It turns exports from Nessus, Greenbone/OpenVAS, Qualys, Rapid7, Nuclei, Burp, Defender and other network, host and web scanners into clear, client-ready reports, and can open HaloPSA or ConnectWise tickets after you review them. Your first three reports are free, and a free pre-flight check shows what it can read from your export first.

— Brandon Sooknanan Founder, Varaxon Technologies