A scan looks for known weaknesses
A vulnerability scan uses automated tools to check your systems against long lists of known weaknesses, such as missing updates, outdated software and common misconfigurations. It is quick, can cover many systems at once, and is useful for catching problems as they appear. It does not try to use what it finds, so it cannot show how far an attacker could get, and some of its results need checking by a person.
A penetration test shows what an attacker could do
A penetration test is carried out by people. Testers use tools too, but then try to exploit what they find, combine smaller weaknesses into bigger ones, and look for problems no tool can recognise, such as a flaw in how an application decides who may see or change what. Each finding comes with its business impact and how to fix it.
What each one misses
A scan misses flaws in an application’s logic and anything that takes judgement or several steps to reach. A penetration test covers an agreed scope over a set period, so weaknesses that appear after it ends are not in it. That is why the two work well together.
Choosing between them
If you need to find known weaknesses across many systems, a vulnerability assessment may be enough. If you need to know whether an attacker could reach sensitive data, want to test a new application before it goes live, or need to show customers or auditors independent testing, choose a penetration test. For networks we offer both: a penetration test, or a vulnerability assessment that finds known weaknesses without trying to get in.