MSP practice
Vulnerability scan vs penetration test: what's the difference?
A vulnerability scan finds known weaknesses automatically; a penetration test proves what an attacker could do with them. When clients need each, and how to explain the difference.
Varaxon Technologies · · 2 min read
Two different questions
A vulnerability scan uses an automated tool such as Nessus, Greenbone / OpenVAS, Qualys or Rapid7 to check systems against a database of known vulnerabilities and misconfigurations. It is broad, repeatable and cheap enough to run every month.
A penetration test is a time-boxed engagement in which a skilled tester tries to break in, chaining weaknesses together the way a real attacker would, and documents what they reached. It is deep, creative and expensive enough that most organizations do it once a year or after a major change.
Side by side
| Vulnerability scan | Penetration test | |
|---|---|---|
| Performed by | Automated tool, configured by a technician | Skilled human tester |
| Typical frequency | Monthly or more | Annually or after major change |
| Coverage | Every host in scope | Chosen targets and attack paths |
| Finds | Known vulnerabilities and misconfigurations | Exploitable paths, business logic flaws, chained weaknesses |
| Proves exploitation | No | Yes, within the agreed rules of engagement |
| Output | List of findings to remediate | Narrative of what was achieved, with findings |
Which does a client need?
- Ongoing hygiene: regular vulnerability scanning with remediation tracking. This is the core of a managed security service.
- Compliance: PCI DSS requires both quarterly scans and an annual penetration test; many other frameworks and customers ask for a penetration test periodically.
- Before a big change or after an incident: a penetration test of the affected environment.
- Cyber insurance: applications commonly ask about scanning and patching; some ask about penetration testing for larger policies.
Explaining it to a client
An analogy that works: a vulnerability scan is checking every door and window in the building to see which are unlocked. A penetration test is hiring someone to try to get to the safe. You want the first done every month and the second once a year.
Varaxon Scan Hub is a reporting tool for the first: it turns the scanner's export into a prioritized, plain-language remediation report. It does not perform penetration tests or claim an environment is secure. See what a vulnerability assessment report should include.
Common questions
Can a vulnerability scan replace a penetration test for PCI DSS?
No. PCI DSS v4 requires both: vulnerability scans at least every three months (requirement 11.3) and penetration testing at least once every twelve months and after significant changes (requirement 11.4).
Is a vulnerability assessment the same as a vulnerability scan?
The terms are often used interchangeably. Strictly, the scan is the automated check, and the assessment includes reviewing the results, prioritizing them and recommending fixes, which is what the report delivers.
Turn your next scan export into a client-ready report.
Run a free pre-flight check