Security Education

Penetration Test vs Vulnerability Scan

They are not the same thing. Here is why the distinction matters.

A vulnerability scan is an automated assessment that identifies known weaknesses using CVE databases. A penetration test is a manual engagement where a security tester actively exploits vulnerabilities, chains findings together and tests business logic flaws that scanners cannot detect. Organizations need both but must understand which is appropriate for their security objectives and compliance requirements.

We hear it constantly: "We already ran a vulnerability scan so we are good." That statement reflects a misunderstanding that puts organizations at risk. A vulnerability scan and a penetration test serve different purposes, operate at different depths and produce fundamentally different results.

Automated Assessment

What a Vulnerability Scan Does

Breadth Over Depth

A vulnerability scan runs automated tools like Nessus, Qualys or OpenVAS against your infrastructure. It checks thousands of ports and services against databases of known CVEs. The scan produces a list of potential vulnerabilities ranked by severity score.

This is useful for establishing a baseline. It identifies missing patches, default credentials, outdated software and known misconfigurations. It does not attempt to exploit anything. It does not test whether vulnerabilities can be chained. It does not evaluate business logic.

Limitations

Scanners generate false positives. They flag theoretical vulnerabilities without confirming exploitability. They miss authentication bypass flaws, insecure direct object references, race conditions and any vulnerability that requires human reasoning to identify. A clean vulnerability scan does not mean your application is secure.

Manual Assessment

What a Penetration Test Does

Depth Over Breadth

A penetration test starts where a vulnerability scan ends. A qualified tester takes the scan output as a starting point and then applies manual exploitation techniques. They attempt to chain low-severity findings into high-impact attack paths. They test business logic, authentication flows, authorization boundaries and session management.

The tester thinks like an adversary. They move laterally through your network, escalate privileges and demonstrate what a real attacker could achieve with the same access. The deliverable is not a list of CVEs. It is a narrative of what was exploited, what business data was accessed and what the actual risk is to your organization.

Business Logic Testing

Scanners cannot test whether your e-commerce platform allows negative-quantity orders. They cannot determine if your API lets User A access User B's records by changing an ID parameter. They cannot find that your password reset flow leaks valid email addresses. These are the vulnerabilities that lead to real breaches. Only manual testing finds them.

Comparison

Side-by-Side Breakdown

Factor Vulnerability Scan Penetration Test
Methodology Automated tool-based scanning Manual exploitation by skilled tester
Depth Surface-level known CVEs Deep exploitation with chaining
False Positives High (unvalidated findings) Low (each finding is confirmed)
Business Logic Not tested Fully tested
Report Quality Automated output with CVE references Narrative with proof-of-concept and remediation
Cost $1,500 - $3,000 (Quick Audit) $5,000+ (Standard Pentest)

Guidance

When You Need Which

Choose a Quick Audit ($1,500) when:
You need a baseline assessment of known vulnerabilities. You want to identify missing patches and misconfigurations before a deeper engagement. You have a limited scope with a single external target. This is closer to a validated vulnerability scan with light manual testing.
Choose a Standard Penetration Test ($5,000) when:
You need to meet compliance requirements (PCI DSS, SOC 2, ISO 27001). You are preparing for investor due diligence. You need to test business logic, authentication and authorization. You want a report that demonstrates real-world impact with proof-of-concept exploits.
Choose both when:
Your compliance framework requires both automated scanning and manual testing. You want continuous vulnerability scanning between annual penetration tests. You are building a mature security program with layered assessment.

Related

Penetration Testing Services

Network, application, cloud and red team penetration testing aligned to PTES and OWASP standards.

Penetration Testing Cost in 2026

Transparent pricing for Quick Audit, Standard and Comprehensive penetration testing engagements.

Order Online

Purchase a penetration test or security audit online with no meetings required.

Get Started

Know which one you need?

Order a Quick Audit from $1,500 or a Standard Penetration Test from $5,000. No meetings required.

Order Online

Not Sure Which You Need?

Call us. We will recommend the right assessment for your infrastructure, compliance requirements and budget. No pressure. No upsell.

Call 604.229.1994
Phone
604.229.1994
Burnaby Office
Burnaby, BC, Canada
Coquitlam Office
Coquitlam, BC, Canada
Quick Audit
Starting at $1,500