Short answer: A vulnerability scan is an automated check that lists known weaknesses, such as missing patches and risky settings, across your systems. A penetration test is a hands-on exercise where a qualified tester tries to exploit those weaknesses the way an attacker would, to show what could actually happen. Scans give you breadth and can run often. Penetration tests give you depth and proof. Most businesses need both.
The two terms are often used as if they mean the same thing, and some providers sell a scan under the name “pen test”. Knowing the difference helps you buy the right thing and read the results properly.
Vulnerability scanning vs penetration testing at a glance
| Vulnerability scanning | Penetration testing | |
|---|---|---|
| How it’s done | Automated tools | A skilled tester, supported by tools |
| What it answers | “What known weaknesses do we have?” | “What could an attacker actually do with them?” |
| Depth | Wide but shallow | Narrower but deep |
| False positives | Common, results need checking | Low, findings are confirmed by hand |
| How often | Regularly, for example monthly or after changes | Periodically, and after major changes |
| Output | A list of issues ranked by severity | A report with proven attack paths and a prioritised fix list |
| Best for | Ongoing hygiene and patch tracking | Testing real-world risk and your defences |
What a vulnerability scan finds
A scan compares your devices, servers, websites and cloud services against databases of known issues. Typical findings include:
- Missing operating system and application patches
- Outdated software that no longer gets security updates
- Open ports and services that shouldn’t be exposed
- Weak or default configurations
- Expired or misconfigured certificates
Scans are fast and repeatable, which makes them good for spotting new problems as your environment changes. Their weakness is context. A scanner can’t tell whether a “critical” issue is actually reachable, or whether three “medium” issues chained together open a serious path in.
What a penetration test adds
In a penetration test, a tester works through your environment within an agreed scope and rules. They look for ways to:
- Get from the internet into your network or apps
- Move from one compromised account or device to others
- Escalate ordinary user access to admin access
- Reach sensitive data such as finance records or customer information
Because a person is doing the work, a penetration test can find logic flaws, chained weaknesses and process gaps that automated tools miss. It also confirms which findings are real, so you don’t waste time on false alarms.
At Loginet, penetration testing is carried out in-house by CEH-certified testers, under an agreed scope and written authorisation before any testing starts.
Which one do you need first?
| Your situation | Start with |
|---|---|
| You’ve never checked your systems | A vulnerability scan, then fix the obvious issues |
| You patch regularly and want to know your real risk | A penetration test |
| You’ve just launched a new website, app or cloud environment | A penetration test of that system |
| A customer, insurer or partner has asked for evidence of testing | Usually a penetration test, check what they ask for |
| You want to track improvement month to month | Regular vulnerability scans |
A sensible pattern for most small and medium businesses is regular scanning to keep on top of hygiene, with a penetration test on a periodic basis and after big changes.
How both fit into a cyber security assessment
Scanning and penetration testing are parts of a wider picture. A cyber security assessment also looks at Microsoft 365 settings, backups, policies and how staff handle email. Loginet’s assessment ends with a written report and a prioritised fix list, so you know what to do first. Between tests, 24/7 threat monitoring watches for suspicious activity as it happens.
If you’re working towards the Essential Eight, see Essential Eight maturity levels explained for how testing evidence fits the maturity model.
Questions to ask before you book a test
- Is this an automated scan, a manual penetration test, or both?
- Who does the testing, and what certifications do they hold?
- What exactly is in scope: external, internal, web apps, cloud, Wi-Fi?
- What are the rules of engagement, and who signs the authorisation?
- What will the report include, and will it rank fixes by priority?
- Is a retest included to confirm the fixes worked?
Frequently asked questions
What is the difference between penetration testing and vulnerability scanning?
A vulnerability scan uses automated tools to list known weaknesses. A penetration test uses a skilled tester to try to exploit weaknesses and show what an attacker could actually achieve.
Is a vulnerability scan the same as a pen test?
No. A scan only identifies possible issues. A pen test confirms which issues are real and how they could be combined into an attack.
How often should a small business run a vulnerability scan?
Regularly, and after any significant change such as a new server, website or cloud service. Many businesses scan monthly.
How often should we get a penetration test?
Periodically, and whenever you make a major change such as launching a new app or moving to the cloud. Some customers or insurers set their own requirements.
Who does Loginet’s penetration testing?
Our penetration testing is done in-house by CEH-certified testers, under an agreed scope and written authorisation.
Will a penetration test disrupt our business?
Testing is planned to avoid disruption. Scope, timing and any systems to avoid are agreed in writing before testing starts.
Find out where you really stand
If you’re not sure whether you need a scan, a penetration test or both, we can help you decide. Book a free 30-minute strategy call to talk through your systems and what you need to prove. See our cybersecurity consulting services for more detail.
