Vulnerability assessment vs penetration testing
A vulnerability assessment tells you what known weaknesses you have. A penetration test tells you what an attacker could actually do with them. Here is how they differ, when you need each, and how to buy them together.
The short answer
A vulnerability assessment uses automated scanning tools to look across your systems for known weaknesses, such as missing updates or insecure settings, and lists them by severity. It is broad, quick and repeatable.
A penetration test is carried out by a skilled tester who goes further: confirming which weaknesses are real, how they could be combined, and what an attacker could reach as a result. CREST’s buyer’s guide describes penetration testing as more rigorous and intrusive than a vulnerability assessment, and dependent on human interaction with the systems in scope.
- Question it answers
- Vulnerability assessment: What known weaknesses do we have?
- Penetration test: What could an attacker actually do?
- How it is done
- Vulnerability assessment: Mostly automated scanning
- Penetration test: Manual-led testing by a skilled person
- Breadth and depth
- Vulnerability assessment: Wide coverage, shallow
- Penetration test: Narrower scope, much deeper
- How often
- Vulnerability assessment: Regularly, as part of vulnerability management
- Penetration test: Periodically, and after significant change
- What you get
- Vulnerability assessment: A list of issues by severity
- Penetration test: A report of confirmed findings, impact and fixes
| Aspect | Vulnerability assessment | Penetration test |
|---|---|---|
| Question it answers | What known weaknesses do we have? | What could an attacker actually do? |
| How it is done | Mostly automated scanning | Manual-led testing by a skilled person |
| Breadth and depth | Wide coverage, shallow | Narrower scope, much deeper |
| How often | Regularly, as part of vulnerability management | Periodically, and after significant change |
| What you get | A list of issues by severity | A report of confirmed findings, impact and fixes |
Why most organisations need both
The NCSC treats scanning as one part of a wider vulnerability management programme: find your systems, scan them, sort the results and fix what matters. Its scanning guidance is clear that automated scanning cannot compare to manual testing such as penetration testing for breadth and depth, and recommends using the two together.
The NCSC’s penetration testing guidance makes the same point from the other side: a penetration test is a snapshot at a point in time, so it should not be your only way of checking security. Used well, a test also tells you whether your everyday vulnerability management is working.
The ICO’s guidance on UK GDPR security names both vulnerability scanning and penetration testing as ways to meet the requirement to test your security measures regularly, and leaves the choice of method and frequency to you, based on the data you hold.
When to choose which
- You have no regular scanning: start with a vulnerability assessment and keep it running. It catches the common, known problems.
- You are launching or changing something important: commission a penetration test of that system, such as a web application test.
- A customer, auditor or standard asks for a pen test: a scan will rarely satisfy them. PCI DSS, for example, requires both as separate requirements.
- You need a certificate for a contract: that may be Cyber Essentials Plus, which is neither a scan you run yourself nor a penetration test.
Buying them together
Many firms sell vulnerability assessment and penetration testing as one engagement (VAPT). When you compare quotes, ask each firm to say how much of the work is automated scanning and how much is manual testing, who does the manual work, and whether the report separates scanner findings from confirmed, tested findings. A report that is mostly scanner output is a vulnerability assessment, whatever it is called.
Next steps
Sources
- NCSC: Vulnerability scanning tools and services
- NCSC: Vulnerability management
- NCSC: Penetration testing guidance
- CREST: A cyber buyer's guide to vulnerability assessment and penetration testing
- PCI Security Standards Council: Information supplement: Penetration Testing Guidance
- ICO: A guide to data security
Frequently asked
Is a vulnerability scan the same as a penetration test?
No. A vulnerability scan is an automated check for known weaknesses. A penetration test is carried out by a skilled person who works out which weaknesses can actually be used, how they combine, and what an attacker could reach. The NCSC notes that automated scanning cannot match manual testing such as penetration testing for breadth and depth.
What is VAPT?
VAPT stands for vulnerability assessment and penetration testing: the two bought together, usually with regular scanning across the whole estate and a periodic penetration test of the most important systems.
Which should I buy first?
If you have no regular scanning, start there: it finds the common, known issues cheaply and continuously. Commission a penetration test when you need assurance about a specific system, before a launch, after a major change, or because a customer, auditor or standard asks for one.
Does a compliance standard accept a scan instead of a pen test?
Usually not. PCI DSS, for example, requires both regular vulnerability scanning and penetration testing, as separate requirements. Check the wording of the standard or contract you are working to.
Compare UK penetration testing companies
Filter firms by service and accreditation, then contact the ones you like.
Browse the directory