Businesses buy "a pentest" and receive a vulnerability scan. Or they run scans for years and believe they have been tested. The two are routinely confused - sometimes by accident, sometimes by vendors who profit from the confusion. Here is the difference in plain language, and how to decide which one you actually need.
What a vulnerability scan is
A vulnerability scan is automated. Software probes your systems, compares what it finds against a database of known weaknesses, and produces a report. It is broad, fast, repeatable, and relatively cheap. A good scan answers the question: "Which known weaknesses exist across my environment?"
Its limits are just as important. A scanner cannot chain two medium-severity issues into a critical breach path. It cannot test business logic - whether a customer can see another customer's invoices by changing a number in a URL. And it produces false positives, which is why unverified scan reports so often rot unread in an inbox.
What a penetration test is
A penetration test is a skilled human attacking your systems with permission. The tester does not stop at "this version is outdated" - they exploit the weakness, see what access it grants, and follow the path the way a real attacker would. A good pentest answers a different question: "What could a motivated attacker actually do to us?"
That difference - proving impact rather than listing possibilities - is what makes findings actionable. "SQL injection in the login form" gets a ticket. "We extracted your full customer table through the login form, here is the evidence" gets fixed this week.
The honest comparison
| Vulnerability scan | Penetration test | |
|---|---|---|
| Performed by | Software | Skilled human (with tooling) |
| Answers | What known weaknesses exist? | What can an attacker actually reach? |
| Business logic flaws | Missed | Found |
| Chained attack paths | Missed | Demonstrated |
| False positives | Common | Eliminated by verification |
| Frequency | Monthly or continuous | Quarterly to annually, and after major changes |
| Relative cost | Low | Higher |
Which do you need?
You need scanning if you have never systematically looked at your exposure, you have compliance requirements that mandate regular scanning (PCI DSS does), or you want continuous visibility between deeper tests. Scanning is hygiene - like brushing your teeth.
You need a penetration test if you handle customer data or payments, a compliance framework or enterprise customer requires one (SOC 2 audits and vendor security reviews increasingly do), you are about to launch something significant, or you have been relying on scans alone for more than a year. A pentest is the dental examination - it finds what the daily routine misses.
The right answer for most established online businesses is both, on different rhythms: continuous or monthly scanning for hygiene, and a manual penetration test quarterly or after major releases for depth.
Red flags when buying
- A "penetration test" quote that seems too cheap and turns around in a day - it is almost certainly a rebranded scan.
- A report with no evidence, no reproduction steps, and no severity reasoning - scanner export.
- No scoping conversation before the quote. A real test cannot be priced without knowing what is being tested.
- No offer to re-test fixes. Verification is half the value.
Ask one question of any vendor: "Will a human attempt to exploit the findings, and will I see proof?" The answer separates the two products instantly.