The difference in one sentence each
A vulnerability assessment uses automated scanners to list known weaknesses across many systems, quickly and often.
A penetration test is a person actively trying to break in, chaining weaknesses together to prove what an attacker could really do.
Side by side
| Vulnerability assessment | Penetration test | |
|---|---|---|
| How | Mostly automated scanning | Mostly manual testing by experts |
| Finds | Known issues: missing patches, weak settings | Logic flaws, broken access control, chained attacks |
| Proof | Lists possible issues | Shows real impact with evidence |
| False positives | Common | Rare, because findings are verified |
| How often | Weekly to monthly | Yearly and after big changes |
| Cost | Lower | Higher |
What scanners miss
Scanners are good at spotting a server that is missing a patch (a security update). They are poor at understanding your application. They will not notice that a normal user can change one number in a request and see another customer's invoices. They miss a discount that can be applied twice, or an AI chatbot that can be talked into revealing data. Those are the issues attackers use most, and they need a human to find.
Which one do you need?
- Vulnerability scanning for routine checks across all your systems. It is cheap enough to run all the time.
- A penetration test for your important applications and before audits, big deals or launches.
- Both for most companies going through SOC 2, ISO 27001 or PCI DSS (common security and payment standards). Auditors expect ongoing scanning and periodic manual testing.
We run scheduled scanning as part of our ongoing controls service and manual penetration tests, so the two feed into one list of fixes.
Need a hand with this?
Talk to a senior consultant. We reply within one business day with clear next steps and a scoped quote.
Written by
NextGarrison Security TeamPenetration testers, SOC analysts and compliance consultants
Our consultants test applications and networks, run 24/7 security monitoring and prepare companies for SOC 2, ISO 27001 and PCI DSS assessments. We write about what we see in real engagements, in plain English.