Penetration testing vs. vulnerability scanning: What’s the difference?

A vulnerability scan is an automated check for known weaknesses across your systems. A penetration test is a person trying to break in the way a real attacker would. When you compare penetration testing vs. vulnerability scanning, the answer for most organizations is that you need both, on different schedules, for different reasons.

The stakes are higher than they were. Verizon’s 2026 Data Breach Investigations Report found that exploiting vulnerabilities was the initial way in for 31% of breaches, ahead of stolen passwords. The weaknesses are usually known. They just haven’t been found and fixed yet.

Penetration testing vs vulnerability scanning at a glance

Neither replaces the other. A pen test on a network that has never been scanned mostly finds missing patches, which wastes the tester’s time. A network that is only ever scanned may still have a path to your most sensitive data that no automated tool flags.

What a vulnerability scan (or vulnerability assessment) does

Scanning software checks computers, servers, network devices and websites against a large database of known flaws. It looks for missing updates, outdated software, open ports that shouldn’t be open, weak settings and default passwords.

You want two kinds. External scans look at what anyone on the internet can see, such as your firewall, remote access portals, websites and email servers. Internal scans run from inside your network and find what an attacker could use after getting a foothold, for example through a phishing email. Many serious incidents start with one compromised laptop and spread from there.

What a penetration test does

NIST describes penetration testing as security testing in which evaluators mimic real-world attacks to find ways around the security features of an application, system or network. The tester usually has a goal, such as reaching the accounting system or a file share with client records, and uses the techniques criminals use to get there.

Where a scan says a weakness exists, a pen test shows how much it matters. A medium-rated finding might turn out to be the first step toward full control of your network, while a high-rated one might be unreachable in practice.

Tests come in four common types. An external network test attacks your internet-facing systems. An internal test assumes the attacker is already on a workstation. A web application test focuses on client portals, online forms and custom apps. A social engineering test uses phishing emails or phone calls to see whether staff can be tricked, which is worth pairing with ongoing employee training.

How often you need each

Several rules already set a minimum schedule, and they make a sensible baseline even if none apply to you:

• The FTC Safeguards Rule requires covered financial institutions, which includes many tax preparers, accountants and lenders, to use continuous monitoring or, without it, run penetration testing annually and vulnerability assessments at least every six months.
• PCI DSS v4 requires businesses that handle card data to run internal and external vulnerability scans at least every three months, with external scans by an Approved Scanning Vendor, and penetration testing at least every 12 months and after significant changes.
• The current HIPAA Security Rule requires a risk analysis but doesn’t set a testing schedule. HHS’s proposed update would require vulnerability scanning at least every six months and penetration testing at least once every 12 months. It had not been finalized as of this writing.

Test again after major changes, such as a new firewall, an office move, a new client portal, a cloud migration or a merger.

How we handle testing for clients

Penetration testing is quoted separately for each engagement, and we run it along with an annual vulnerability assessment. Pairing them means the scan clears out the known, easy findings and the tester can concentrate on how an attacker would chain weaknesses together. The ongoing side, from inventory to rescans, is covered in our post on effective vulnerability management.

Turning results into fixes

Verizon also found the median time to fully fix critical vulnerabilities rose to 43 days. A short process shortens that window:

• 01Give every finding an owner and a due date based on severity.
• 02Fix anything on CISA’s Known Exploited Vulnerabilities catalog first.
• 03Rescan to confirm each fix worked.
• 04Document exceptions. If something can’t be patched, such as an old piece of medical or lab equipment, record why and what compensating control protects it.
• 05Keep scan reports, pen test reports and remediation notes. Auditors, insurers and regulators will ask for them.

Questions to ask a penetration tester

1. Can we see a sample report, written for both leadership and the people who fix things?
2. Will scope, timing and rules of engagement, including who to call if something breaks, be agreed in writing before testing starts?
3. Are you independent of the team that runs our systems?
4. Will the report map findings to the frameworks we answer to, such as PCI DSS or the FTC Safeguards Rule?
5. Is a retest of fixed items included?

Before you sign a pen test engagement for an auditor, insurer or client, settle what kind of test you need. Book a 15-minute call and we can talk through scope and how testing fits with our cybersecurity services and compliance services.

Frequently asked questions