Penetration Test vs Vulnerability Scan.

File · Answer first

Answer first

You run both, on different clocks, because they answer different questions. A scan runs weekly and tells you which known issues are present right now. A pentest runs annually or per release and tells you which of those issues an operator can chain into something that actually hurts the business. Drop the scan and you lose coverage of the known class between tests. Drop the pentest and you never learn what the chain looks like. The rest of this page is how to place each one in a program.

File · What each

What each one actually delivers

• [01] Vulnerability scan: a list of CVEs and misconfigurations detected by signature. Fast, cheap, mostly automated. Useful for hygiene tracking.
• [02] Penetration test: attack-path narratives showing how a chain of low-severity findings leads to high-severity business impact. Slow, operator-led, manual. Useful for board, audit, and remediation prioritization.

File · How to

How to use both

Run continuous scans for hygiene. Commission a manual pentest at the cadence your audit or risk program requires. The scan catches the known class. The pentest catches what the scan structurally cannot see. One warning when you buy the pentest: if the deliverable is a Burp or Nessus export under a nicer cover page, what you paid for was the cover page. That is the scan you could have run yourself.