Penetration Test vs. Vulnerability Scan: What's the Difference?

Vulnerability scan: what's patched, automatically

A vulnerability scan is an automated tool comparing your systems against a database of known vulnerabilities and misconfigurations, then producing a list: outdated software versions, missing patches, weak TLS configurations, default credentials on known services. It runs in hours, costs relatively little, and is genuinely useful as a recurring baseline check — the problem is what it structurally can't see.

A scanner has no concept of your application's business logic. It won't notice that a "cancel order" endpoint doesn't check who placed the order, or that three individually low-severity Active Directory misconfigurations chain together into a path to Domain Admin. It flags known signatures; it doesn't reason about how an attacker would actually move through your environment.

Penetration test: what's actually exploitable, manually verified

A penetration test is a person — or team — manually attempting to exploit your systems the way a real attacker would, chaining findings together, testing business logic, and validating that a vulnerability is actually reachable and exploitable rather than theoretically present. It takes days, not hours, and costs more, because it's fundamentally labor, not compute.

The output is different too: not a list of CVEs, but a narrative of what an attacker could actually do — the specific path from an entry point to a meaningful compromise, with evidence, plus a report written for both your leadership and your engineers.

Side by side

• Method: scan = automated signature matching. Pentest = manual exploitation and chaining.
• Finds: scan = known CVEs, missing patches, misconfigurations. Pentest = those, plus business logic flaws, chained attack paths, and authorization gaps.
• Timeline: scan = hours. Pentest = days, depending on scope.
• Compliance: most frameworks (SOC 2, PCI DSS) require both — scans on a recurring cycle, penetration testing at least annually.

Which one do you need?

If you need a recurring baseline health check between deeper assessments, a vulnerability scan has its place. If you need to know whether your actual defenses hold against a determined attacker — or you need evidence for a SOC 2 or PCI DSS audit — you need a penetration test. Most mature security programs run both: scans frequently, penetration tests annually or after major changes.

See what's covered in web application or Active Directory penetration testing, or check pricing for both.