Penetration testing vs vulnerability scanning: What’s the difference?
Penetration testing and vulnerability scanning are two essential tools for you to employ as a part of your ongoing security activities. They work hand-in-hand to give you an in-depth, technical view of the vulnerabilities you have in your computer systems. There’s significant overlap between the two, in that penetration tests will often include a vulnerability scan but that’s really where the similarities finish. Vulnerability scanning is more geared towards identifying specific vulnerabilities in computer systems, whereas penetration testing goes one (or several) steps further and actively tries to exploit those vulnerabilities to compromise your infrastructure.
Cybersecurity is a Very Broad Church. The cybersecurity family tree has branches that extend to physical security, supply chain security, information security and even cryptography. These are all quite far away from the trunk, and it’s not uncommon for two people who both identify as ‘cybersecurity specialists’ to have very little idea what the other is talking about.
Take me, for instance. I’m a security consultant, specifically a penetration tester and my expertise is in web applications, and I hold the Cyber Scheme Team Member (CSTM) qualification. A friend of mine is also a security consultant but holds a Certified Information Systems Security Professional (CISSP) qualification. We learn a lot from each other when we talk shop, and I’m constantly amazed about how two people with the same job title and two entirely different experiences of working in the same industry.
Been tasked with procuring security services?
I’m left painfully aware of just how daunting it might be for most people who don’t work in cybersecurity but find themselves responsible for procuring security services. Many years ago, the company I worked at was delivering a web application to our client, who was using the app as part of what they were delivering to their client. Their client was, shall we say, a household name in information technology.
So, quite naturally, there was the small matter of sharing our business continuity plan, incident response plan, various other policies, and the most recent report from the last time the application was pen-tested. We were a small, local web app business with less than ten full-time employees. We didn’t exactly have that kind of stuff lying around.
What followed was one of the most intense months of my life, as I dove headfirst into the world of information security and cybersecurity the likes of which I’d never seen before. I ploughed into dozens of blog posts, watched hours of videos and talked to every single industry professional who’d give me the time of day – I really cashed in a lot of the goodwill chips I’d been building up over the years, and I suspect that some of those debts are still on my balance sheet.
The end result? We managed to pass the requirements in record time, and we became a much more robust and resilient business as a result. And I finally learned to love the new grey hairs that showed up to support me on my journey.
One of the hardest things I realised was internalising the information that I’d learned. I’d be jumping between different information domains, trying to understand the real-world implications of ideas that can seem ephemeral – and this is especially true in the information age.
If we were mostly dealing with tangibles and physical things, it would be easy to point at a machine and say “Well, if that machine goes down it’ll take us 48 hours to repair, and we’ll have enough stock to fulfil two days’s worth of orders so our recovery time objective should be…”. This is why I like analogies. It’s why my articles inevitably lean quite heavily on them.
In part, I’m trying to help people to build and develop intuitions for complex subjects. In part, I’m trying to draft the articles that I needed when I was trying to answer questions like “What does a penetration test do that a vulnerability scan doesn’t?”. Without further ado (or digression), let’s answer that question.
A physical analogy for your organisation
In a recent article on red teaming (and how it differs from pen testing), I used the analogy of the 2001 classic heist movie Ocean’s Eleven. I argued that if they had delivered a report at the end of the operation–and given the money back–then it would have effectively been a movie about a red team engagement.
Assuming that the majority is predicated on the basic idea of ‘doing things so that stuff that you have at the start of the day is still there at the end of it’, we’ll keep the vault from Ocean’s but move it into a fictional bank with no Hollywood association. This bank will represent your business infrastructure.
In both vulnerability scanning and pen testing, the two most common types of infrastructure testing that we perform are internal and external infrastructure testing.
Let’s consider our bank.
Our external infrastructure can be thought of as anything that’s accessible from the street, by the public. “Seems easy enough”, you might think before you go off and ensure that all your ground-floor windows and doors are properly secured. The problem here is that criminals are nothing if not inventive and determined in their attempts to get into your vault.
You might overlook, for example, the third-floor window to the kitchen that’s always open: surely no one is going to either a) notice it or b) bring a ladder long enough. Now, imagine your surprise when a team of bad guys turn up in the dead of night with a scissor lift.
For your external infrastructure, the ‘street’ becomes the entire internet, meaning any device that you own that is exposed to the internet is a part of your external infrastructure.
Internal infrastructure is considered anything that is inside of your bank, and more specifically anything that you want to control access to both from the public and your employees. This is going to include all your high-value targets–especially things like tills, document storage and the very large safe where you keep your gold.
To add to this, there might be areas within your internal infrastructure that overlap with your external infrastructure such as main lobby areas that are accessible to the public but locked at night. In reality, your internal infrastructure comprises employee laptops, database servers, firewalls, routers and other network equipment. You’ll need to include network storage and file shares within this as well as the extremely valuable domain controllers.
Internet-facing web servers can also sometimes find themselves bridging the gap between internal and external infrastructure so it’s always worth thinking about them in both domains – the publicly accessible lobby or information desk.
Having successfully identified the difference between our internal and external infrastructures, let’s carry on with this analogy by way of introducing two new characters who will play the complimentary but different roles of vulnerability scanning and penetration testing.
Vulnerability scanning: The diligent head of neighbourhood watch
Introducing the first of our cybersecurity practitioners: the vulnerability scanner.
Our vulnerability scanner is a tireless and diligent watchdog whose goal is to identify and catalogue every vulnerability that may exist inside and outside of your business. There they stand, clipboard in hand, binoculars around their neck, purposefully looking at every door, window, air vent and drainpipe.
They’ve got an encyclopaedic knowledge of all the potential security issues that are associated with everything they find and they’re relentless in their cataloguing of all and any issues no matter how small.
Our vulnerability scanner will try to tell you the make and model of every door to your building, and they’ll cross-reference that information against any manufacturer advisories that were released, such as if there’s a common defect with a hinge that would allow would-be attackers to remove it altogether.
In infrastructure terms, this means your vulnerability scanner will be identifying all devices on your network and probing each of them in turn. A vulnerability scan will use various techniques to identify the make and model of all network devices as well as look for evidence of any software versions they might be running so that this can be compared to the vast database of vulnerabilities each scanner contains.
Every vulnerability, no matter how small, is logged and detailed, and you’re able to use the scanner interface to filter through the results as they’re identified. Vulnerability scanners also categorise their findings by criticality, often using the Common Vulnerability Scoring System (CVSS) which gives you a convenient way of filtering through the findings and prioritising any remediations that might be needed.
You also have options in terms of how thorough you want Mr./Mrs./Mx.V. Scanner to be: you can provide them with the credentials to gain deeper levels of access to your infrastructure. This would be the equivalent to giving our tireless scanner sufficient access to look in areas that might be restricted to upper management, security-only areas or even just the elevators that can access any floor, unrestricted.
Thus, vulnerability scanners can be configured with valid credentials which will then be used to authenticate against relative services and allow them to test devices from a deeper perspective. This use of credentials is essential when you’re performing scans such as build reviews and wish to test against certain benchmarks.
Penetration testing: Your friendly neighbourhood cat burglar
A penetration tester, on the other hand, is like a friendly neighbourhood cat burglar; a skilled thief who, instead of stealing valuables, breaks into buildings to point out the actual security flaws to the owner.
They know how to pick locks, scale walls, and gain entry through third-floor windows; they are masters of bypassing security measures and chaining together several smaller issues to make one big one. But instead of stealing off into the night with a bag marked ‘swag’, they’re doing all of this to make sure that others can’t do the same.
This is the heart of penetration testing: identifying real weaknesses in systems and networks, exploiting and reporting them before the bad guys do.
A key part of penetration testing is vulnerability scanning: this is like our friendly burglar walking around with our vulnerability scanner and checking for obvious signs of weaknesses — unlocked doors, open windows, faulty security cameras and things like that.
However, whilst the vulnerability scanner’s tools of choice are the clipboard and encyclopaedic knowledge, the penetration tester’s tools are the same as the very adversaries that you’re trying to defend against.
A penetration tester will work hand in hand with a vulnerability scanner, check through their findings and decide on a plan of action to try to gain access to your building. That might be as simple as walking in through an unlocked side entrance, or it could be more complex such as bypassing the electromagnetic locks on a door or putting an elevator into maintenance mode to access restricted floors.
In systems terms, the penetration tester is actively trying to find and exploit vulnerabilities in networks. This is done using the same tactics, techniques and procedures as cybercriminals. This means that the penetration tester will scan network devices, identify high-value targets and perform attacks against those targets to actively exploit any issues they find. This will include things like trying to gain access to network shares, stealing user credentials in transit to re-use and, of course, attempting to take over the entire network domain by compromising a domain controller to gain domain admin permissions.
Vulnerability scanning doesn’t have the same hands-on, creative problem-solving as penetration testing, but it’s still a crucial step in identifying and cataloguing potential risks.
Depending on the configuration of the scanner, it can often be a faster way of giving a broad overview of weaknesses in a system. This allows penetration testers to focus their efforts on the most critical areas.
Vulnerability scanning and penetration testing go hand-in-hand
You can also think of vulnerability scanning and penetration testing in healthcare terms. Vulnerability scanning would be a routine health check and penetration testing would be a specialised diagnostic procedure.
In the same way that you wouldn’t wait for serious symptoms to go and see a doctor, you shouldn’t rely solely on penetration testing to understand the security of your infrastructure.
Likewise, frequent vulnerability scans can catch issues early, enabling you to address them before they become significant problems, but they can’t show you how multiple vulnerabilities might be chained together to compromise a system.
Periodic penetration tests offer deeper insights into your security posture, in many cases simulating real-world attack principles to uncover vulnerabilities that scan alone might miss.
Consider, if you will, the infamous Equifax breach of 2017. A vulnerability in the Apache Struts framework went unpatched. This allowed attackers to access and exfiltrate the data of over 140 million people.
Detecting unpatched software is bread-and-butter for a vulnerability scanner, and it’s possible that regular vulnerability scanning could have identified the outdated software. Even if the system administrators didn’t see a significant risk, a penetration test might have been able to simulate and document the exact exploit path used by the attackers. No doubt a report stating ‘Apache Struts exploit to customer data accesses would have prompted a timely fix.
Should you get a penetration test or vulnerability scan? Our advice
Both vulnerability scanning and penetration testing make a powerful combination when you combine them into your security strategy. In a landscape where cyber threats evolve constantly, a proactive approach is critical.
Ultimately, both tools are an indispensable part of your security posture and work together to help you identify and remediate issues that could give cybercriminals the leverage they need to infiltrate your systems.
Vulnerability scanning should be performed regularly, serving as an ongoing measure to catch and address common issues.
Penetration testing, on the other hand, should be conducted periodically; to give you a more comprehensive assessment of your defences.
Together, they make a potent strategy, helping you keep your networks one step ahead of the bad guys. Use them both to strengthen your security posture and build resilience against the ever-changing landscape of cyber threats.
| Vulnerability Scanning Benefits | |
|---|---|
| Important for compliance: | Regular vulnerability assessment and management is considered a foundational security control. A personal data breach caused by exploitation of a vulnerability that could have been picked up and prevented through scanning is, for example, likely to be a breach of Article 32 of the General Data Protection Regulation (“GDPR”). Likewise, Payment Card Industry Data Security Standard (“PCI DSS”) compliance requires quarterly scanning of the Cardholder Data Environment. |
| Reduces risk: | External infrastructure is constantly being scanned and probed by attackers to try and find a foot hold, and new vulnerabilities are being discovered all the time. Once inside your network, attackers will seek to exploit vulnerabilities to move from their entry point to access your most sensitive data. By regularly checking the health of networks and services, they help companies find and fix weaknesses, before cyber threat actors take advantage of them. |
| Quick and repeatable: | Automation requires little human intervention and works at high-speed. It’s therefore easy to incorporate these tools into the business and run regular scans. |
| Shortcomings | |
| False positives: | The speed of the service means that velocity sometimes trumps accuracy. Scans can produce lengthy reports for IT staff to go through, only to find that many of the red flags are, in fact, false positives. The scanning is the fast part, validating the vulnerabilities that apply, prioritising them and fixing them takes longer. To understand the likelihood of a vulnerability being exploited, you’ll need a human who knows your environment to review the vulnerability in the context of your organisation. This can be slow and require specialist security knowledge. |
| Unfound vulnerabilities: | It’s unlikely a scan will find every weakness. This may be because the vulnerability is too complex or newly discovered. Regardless, unknown vulnerabilities leave businesses open to exploitation. Plus, a scanner also doesn’t apply heuristic thinking. Sometimes attackers will use a combination of vulnerabilities which, together, make the risk much higher than when viewed in isolation. |
| Generic remediation guidance: | Once the list of vulnerabilities is received, it will typically come with generic remediation information that the organisation will need to validate and then work out how to apply in the context of their systems. |
| Penetration Testing Benefits | |
|---|---|
| Validation: | In comparison to vulnerability scans, penetration tests are much more meticulous and in-depth. They provide assurance and validation that defences are resilient, that identified vulnerabilities are applicable and provide actionable guidance on steps required to fix the problems. |
| Reduces the likelihood of a data breach: | In discovering weaknesses and advising on how to fix them, they significantly reduce the likelihood of a harmful cyber-attack by providing organisations with the information they need to remediate the issues and/or manage the risks. |
| Important for compliance: | We noted article 32 of the GDPR above. This makes pen-testing an important part of an organisation’s compliance activities. Likewise, penetration testing is an expectation within PCI DSS. |
| Fulfils supply chain obligations: | More and more supplier contracts are mandating annual pen-testing of systems to ensure the entire supply chain is secure. Copies of penetration testing reports are increasingly being requested during supplier due diligence exercises as well. |
| Shortcomings | |
| Finding a provider you trust: | Penetration testing invites a third-party to find flaws in your systems. It’s therefore essential to find a supplier you have confidence in, and whose pen-testers are certified. |
| Time-consuming: | The manual nature of pen-testing means it takes longer than a vulnerability scan. However, the length and intensity of the activity directly relates to the validation of the output. |
Book your pen test/vulnerability scan
If your organisation needs help running a penetration test on an application or infrastructure, or would like to arrange vulnerability scans, we can help. We can assess your environment and run a full penetration test. We can also advise you on any follow-up actions or remediations from our findings.
Still unsure about where to start? Our comprehensive guide to pen testing costs for 2025, is a good place. Contact us for a friendly chat.
