Penetration Testing vs Vulnerability Scanning: Which One Do You Need?

“Penetration testing” and “vulnerability scanning” get used interchangeably, and buying the wrong one is a common, expensive mistake. Add “vulnerability assessment” to the mix and it gets more confusing, because vendors sell all three under each other’s names. Here is the clear version: what each one is, what it finds and misses, which compliance frameworks require which, what each costs, and how to decide. (For the full picture of how a pentest works end to end, see what is penetration testing.)

The one-line difference

• A vulnerability scan finds known weaknesses automatically. It is broad, fast, and cheap.
• A vulnerability assessment takes scan output and has an analyst validate, deduplicate, and rank it, adding judgment about what matters.
• A penetration test has a skilled human actively exploit weaknesses the way a real attacker would, proving true impact. It is deep, manual, and slower.

Scanning tells you what might be wrong. An assessment tells you what is actually wrong and in what order to fix it. A penetration test proves what an attacker could actually do.

Vulnerability scanning

A vulnerability scan uses automated tools to check your systems against a database of known vulnerabilities, missing patches, outdated components, and common misconfigurations. Our network vulnerability assessment checklist covers how to run one well.

• Strengths: fast, broad, inexpensive, and easy to run on a schedule for continuous coverage across many systems.
• Limits: it only finds known issues, it produces false positives, and it cannot understand context or chain findings. It will never discover a business-logic flaw or an authorization gap between two user roles, because it does not know which user should own which record.

Best used continuously, to catch newly disclosed issues across many systems between deeper tests.

Vulnerability assessment

A vulnerability assessment is the analytical layer on top of scanning: an analyst validates the results, strips out false positives, deduplicates across hosts, and ranks what is left by real risk with business context. It answers “of everything the scanner found, what actually matters and in what order?”

• Strengths: a verified, prioritized list your team can act on, repeatable on a cadence, and the standard evidence for the vulnerability management process most frameworks require.
• Limits: still bounded by what scanners can see. No exploitation, no chaining, no business logic.

Often, scanning and assessment are sold together, and combined with testing under the label VAPT (vulnerability assessment and penetration testing).

Penetration testing

A penetration test is a skilled human actively attacking your systems to prove what is exploitable. Testers chain vulnerabilities, abuse business logic, and demonstrate real impact: “this sequence of calls exports your customer database,” not “this port is open.”

• Strengths: finds the high-severity flaws scanners miss (broken access control, business logic, chained exploits) and proves real-world impact with evidence an auditor accepts.
• Limits: point-in-time, higher cost, and its value depends entirely on tester skill, which is why the tester’s certifications and the share of manual work are the questions to ask any vendor.

Best used periodically, typically annually and after major changes, for depth on your most critical systems.

Side by side

	Vulnerability scan	Vulnerability assessment	Penetration test
Method	Automated	Automated plus analyst validation	Manual, expert-led
Finds	Known issues, with false positives	Known issues, verified and ranked	Known and unknown issues, chained, plus logic flaws
Proves impact	No	No	Yes
Business-logic flaws	Never	Never	Yes
Frequency	Continuous or monthly	Quarterly, or before each retest	Annually and after significant change
Typical output	A raw list	A prioritized list with remediation order	An attack narrative, findings with evidence, a retest, an attestation letter
Answers	“What might be wrong?”	“What is actually wrong, in what order?”	“What could an attacker actually do?”

Which frameworks require which

Nearly every framework separates the two and expects both. The scan or assessment evidences an ongoing vulnerability management process; the penetration test evidences that the controls hold under attack. A scan never satisfies a pentest requirement, however clean the result.

Framework	Scanning or assessment	Penetration test
PCI DSS v4.0	Required: internal and external scans at least quarterly and after significant change (Requirement 11.3), external scans by an Approved Scanning Vendor.	Required: internal and external testing at least annually and after significant change, plus segmentation testing (Requirement 11.4).
SOC 2	Expected as evidence of ongoing vulnerability identification (CC7.1).	Expected by nearly every auditor for the Security criteria, inside each Type II window.
HIPAA	Periodic evaluation required; the proposed 2025 update would require scans every six months.	Periodic evaluation required; the proposed update would require testing every 12 months.
ISO 27001	Annex A 8.8 technical vulnerability management.	Expected by certification auditors as the evidence that A 8.8 and A 8.29 operate.
NYDFS 23 NYCRR 500	Required: automated scans and manual review at a risk-based frequency (500.5(a)(2)).	Required: annual testing from inside and outside the boundary (500.5(a)(1)).
CMMC Level 2	Required: scan periodically and when new vulnerabilities are identified (RA.L2-3.11.2).	Accepted evidence for periodic control assessment (CA.L2-3.12.1) and the CUI boundary.
Cyber insurance	Applications ask how often you scan and how fast criticals close.	Applications ask for an independent test within the last 12 months.

For the cadence each framework expects, see how often you should do a penetration test.

What each one costs

We publish our prices, so this comparison can use real numbers rather than “contact us.”

	Price	Scope it covers
Vulnerability scan	$1,500 per validated scan	One defined scope, internal or external, validated by an analyst
Vulnerability assessment	$1,500 per assessment	One defined scope: perimeter, internal network, cloud account, or application, verified and ranked
API penetration test	From $4,000	One API, sized by endpoints and roles
External network penetration test	From $4,200	The internet-facing perimeter, sized by live hosts
Web application penetration test	From $5,200	One application with a couple of roles
Internal network penetration test	From $6,000	One site or Active Directory domain

Every penetration test price is fixed in writing before work begins and includes a free retest of remediated findings. Our guide to how much a penetration test costs puts those figures next to the market ranges so you can sanity-check any quote.

The same question, six ways

People ask this in several phrasings and mean the same thing. “Vulnerability scan vs penetration test,” “pen test vs vulnerability scan,” “vulnerability assessment vs penetration testing,” “VA vs PT,” “scanning vs pentesting,” and “is a vulnerability scan a penetration test” all resolve to the table above. The one that trips buyers up is the last: no, a vulnerability scan is not a penetration test, and a vendor who sells a scan report with a cover page as a “penetration test” will not get you through a PCI assessment, a SOC 2 audit, or an enterprise security review. The tell is a report full of missing patches and TLS findings with nothing about access control or business logic.

Which do you need?

• Compliance almost always requires both. PCI DSS is the clearest example: Requirement 11.3 mandates quarterly scans while Requirement 11.4 separately mandates annual penetration testing, and a scan cannot satisfy the pentest requirement. Other frameworks follow the same pattern.
• Ongoing hygiene: scanning, continuously, with an assessment quarterly so someone ranks the output.
• Real assurance before a launch, an audit, or an enterprise deal: a penetration test.
• A validated baseline before your first pentest: a vulnerability assessment, so the test is scoped against what the estate actually looks like.

The honest answer for most organizations is not “either/or” but “both, layered”: continuous scanning for breadth, an assessment to keep the list honest, and periodic penetration testing for depth. We break that layered model down further in a layered approach to AppSec testing, and our guide to vulnerability assessment and penetration testing (VAPT) covers how to scope them as one program.

If you are not sure which your situation calls for, scope an assessment and we will recommend the right mix and price it as a fixed scope.