Fundamentals

Penetration Test vs Vulnerability Scan: They Are Not the Same Thing

> compare --left='vulnerability_scan' --right='penetration_test' --output=the_difference_that_matters<span class="cursor-blink">_</span>_

Hedgehog Security 18 September 2024 21 min read
penetration-testing vulnerability-scanning security-assessment fundamentals risk-management nessus qualys burp-suite security-testing compliance

The most expensive misunderstanding in cyber security.

A CISO requests a penetration test. Procurement sends the requirement to three providers. Two quote £15,000–£25,000 for a week of manual testing by experienced consultants. The third quotes £2,500 for an 'automated penetration test' that will be completed in 24 hours and deliver a comprehensive report. The £2,500 quote wins. What arrives is a Nessus or Qualys scan report — hundreds of pages of automated output listing every CVE detected across every scanned host, sorted by CVSS score, with generic remediation advice copied from the vulnerability database. No manual testing was performed. No exploitation was attempted. No attack paths were mapped. No business context was applied. The organisation files the report, remediates the critical findings, and tells the board they have been penetration tested.

They have not been penetration tested. They have been vulnerability scanned. These are fundamentally different activities — different in methodology, different in depth, different in the skills required to perform them, different in the quality of findings they produce, and critically different in the security decisions they enable. Confusing them is not a semantic quibble. It is the difference between knowing that a vulnerability exists and knowing what an attacker can actually do with it. It is the difference between a list of CVEs and an understanding of risk. And it is, far too often, the difference between an organisation that believes it has tested its defences and an organisation that has merely counted its known weaknesses.

This confusion persists because the terms are used interchangeably by people who should know better — including, regrettably, some providers who sell vulnerability scans as penetration tests because the margin is higher and the client does not know the difference. If you commission security testing, you need to understand what you are buying. If you provide security testing, you have an obligation to be honest about what you are delivering.


What a vulnerability scan actually is.

A vulnerability scan is an automated process in which a software tool scans a defined set of targets — IP addresses, hostnames, URLs, network ranges — and compares what it finds against a database of known vulnerabilities. The scanner probes each target for open ports, running services, software versions, and configuration settings, then cross-references this information against its vulnerability database (which is updated regularly by the scanner vendor) to identify known security issues.

The output is a report listing every identified vulnerability, typically categorised by severity (Critical, High, Medium, Low, Informational) using CVSS scores, along with a description of each vulnerability, its CVE identifier where applicable, and generic remediation guidance. The entire process is automated. The scanner does the work. A human configures the scan parameters, launches it, and reviews the output — but the human does not manually test, exploit, or validate the findings.

Characteristic Detail
Methodology Automated. The scanner follows its programmed logic to probe targets and match findings against a known vulnerability database. No human judgement is applied during the scanning process itself.
Depth Broad but shallow. Scans a wide range of targets quickly, identifying known vulnerabilities based on version numbers, banner information, and configuration checks. Does not attempt to exploit vulnerabilities or determine whether they are actually exploitable in the target environment.
What It Finds Known vulnerabilities with published CVEs, missing patches, insecure configurations, default credentials (in some cases), expired certificates, weak cipher suites, open ports running unnecessary services, and other issues detectable through automated probing.
What It Misses Business logic flaws, chained attack paths, vulnerabilities that require authentication to discover, issues that require human intuition to identify (such as insecure workflows or privilege escalation through legitimate application features), zero-day vulnerabilities not yet in the database, and any weakness that requires creative thinking or contextual understanding to exploit.
False Positives Significant. Vulnerability scanners routinely report vulnerabilities based on version numbers without verifying whether the vulnerability is actually exploitable — for example, flagging a CVE for a specific Apache module when that module is not enabled, or reporting a vulnerability that has been mitigated by a compensating control the scanner cannot detect.
False Negatives Also significant. Scanners only find what they are programmed to look for. Custom application vulnerabilities, novel attack techniques, and issues that require multi-step exploitation are invisible to automated scanning.
Skill Required Moderate. Configuring a scan properly (selecting appropriate targets, choosing scan policies, managing credentials for authenticated scanning, and scheduling to minimise operational impact) requires competence. Interpreting and triaging results requires experience. But the core activity — the scanning itself — is performed by software.
Common Tools Nessus (Tenable), Qualys, Rapid7 InsightVM/Nexpose, OpenVAS, Microsoft Defender Vulnerability Management. For web applications: Burp Suite Scanner, OWASP ZAP, Acunetix, Invicti (formerly Netsparker).
Typical Duration Hours to days, depending on the number of targets and scan depth. A network vulnerability scan of 500 hosts might complete overnight. A web application scan of a single complex application might take several hours.
Typical Cost Low to moderate. Can be performed in-house with licensed scanning tools, or outsourced for a fraction of the cost of a penetration test. Many organisations run vulnerability scans weekly or monthly as part of continuous monitoring.

A vulnerability scan is a valuable, necessary component of a security programme. It provides breadth of coverage, can be run frequently, and identifies known weaknesses that should be remediated through patch management and configuration hardening. What it does not provide — and cannot provide, regardless of how advanced the scanner — is an understanding of what an attacker could actually achieve by exploiting those vulnerabilities in combination, in context, and with human creativity.


What a penetration test actually is.

A penetration test is a manual, human-led assessment in which a skilled security professional — the penetration tester — actively attempts to compromise a target system, application, or environment using the same techniques, tools, and methodology that a real attacker would employ. The objective is not merely to identify that vulnerabilities exist, but to determine what an attacker could achieve by exploiting them — how far they could penetrate, what data they could access, what systems they could compromise, and what the real-world business impact would be.

A penetration tester uses automated tools as part of their methodology — including vulnerability scanners — but the tools are instruments in the hands of a human, not replacements for one. The tester's value lies in their ability to think creatively, chain findings together, exploit vulnerabilities in ways the scanner cannot, identify business logic flaws that no automated tool would detect, and adapt their approach based on what they discover as the engagement progresses. A vulnerability scanner follows a script. A penetration tester follows a thought process.

Characteristic Detail
Methodology Manual, human-led, and adaptive. The tester uses a structured methodology (such as OWASP Testing Guide for web applications, PTES, or OSSTMM) as a framework but exercises judgement, creativity, and intuition throughout. The approach evolves as findings emerge — each discovery informs the next line of investigation.
Depth Narrow but deep. Focuses on specific targets or objectives and investigates them thoroughly — attempting exploitation, chaining vulnerabilities, escalating privileges, and pursuing attack paths to their logical conclusion. Prioritises depth of understanding over breadth of coverage.
What It Finds Everything a vulnerability scan finds, plus: business logic vulnerabilities, authentication and session management flaws, privilege escalation paths, chained attack paths (where individually low-severity findings combine into critical compromises), insecure direct object references, race conditions, server-side request forgery, XML external entity injection, and any other weakness that requires human analysis to identify and exploit.
Exploitation A penetration tester actively exploits vulnerabilities (within agreed rules of engagement) to demonstrate real-world impact. The difference between 'this system is running a version of Apache with a known vulnerability' and 'I exploited that vulnerability to gain shell access, escalated to root, and accessed the patient database containing 50,000 records' is the difference between a vulnerability scan finding and a penetration test finding.
Attack Path Analysis The tester maps how individual findings combine into realistic attack chains. Three medium-severity findings that together enable full domain compromise represent a critical risk — but a vulnerability scanner would report them as three separate medium findings with no indication that they are connected. This is the attack chain analysis we examined in depth in our article on why no critical findings does not mean secure.
False Positives Minimal. Because the tester manually validates findings by attempting exploitation, false positives are identified and eliminated during the testing process. If a vulnerability cannot be exploited, the tester determines why and reports accordingly — the finding may be mitigated by a compensating control, may not be exploitable in the specific configuration, or may be a scanner false positive.
Business Context A penetration tester contextualises findings against the target's business operations. 'SQL injection on the login page' becomes 'SQL injection on the patient portal login page enables unauthenticated access to 200,000 patient records, constituting a reportable breach under HIPAA and UK GDPR with estimated regulatory exposure of £X.' This contextualisation transforms technical findings into business risk that leadership can understand and act upon.
Skill Required High. Penetration testing requires deep technical knowledge of operating systems, networking, application security, cryptography, and attack techniques, combined with creative problem-solving ability, methodical documentation discipline, and the communication skills to explain technical findings to non-technical stakeholders. The quality of a penetration test is directly proportional to the skill and experience of the tester.
Common Tools Manual tools used alongside automated ones: Burp Suite Professional (manual web testing), Metasploit Framework, BloodHound (Active Directory attack path mapping), Impacket, CrackMapExec, Responder, Mimikatz, custom scripts, and many others. The tester selects tools based on the target environment and adapts their toolkit as the engagement progresses.
Typical Duration Days to weeks. A focused web application penetration test might take 5–10 days. An internal network penetration test might take 5–15 days. A comprehensive assessment covering multiple applications, internal and external infrastructure, and wireless might span several weeks. Red team engagements can run for months.
Typical Cost Significantly higher than a vulnerability scan — reflecting the skilled human time involved. The cost reflects what you are buying: not automated output, but expert analysis, creative exploitation, validated findings, attack path mapping, business-contextualised reporting, and a genuine understanding of your risk.

The critical differences at a glance.

Vulnerability Scan Penetration Test
Primary question What known vulnerabilities exist on these systems? What could an attacker actually do to this organisation?
Who does the work Software (the scanner), configured and reviewed by a human. A human (the penetration tester), using software as one of many tools.
Exploitation No. Identifies potential vulnerabilities but does not attempt to exploit them. Yes. Actively exploits vulnerabilities to demonstrate real-world impact and chain findings into attack paths.
Coverage vs depth Broad coverage, shallow depth. Scans many targets quickly for known issues. Focused coverage, significant depth. Investigates specific targets thoroughly for both known and unknown issues.
False positive rate High. Findings are based on version detection and signatures without exploitation validation. Low. Findings are manually validated through attempted exploitation.
Business logic testing No. Scanners cannot understand application workflows or business rules. Yes. The tester analyses application logic, identifies flaws in workflows, and exploits assumptions in business rules.
Attack chain analysis No. Each finding is reported in isolation with no analysis of how findings combine. Yes. The tester chains findings together to demonstrate realistic attack paths from initial access to objective completion.
Adaptiveness None. The scanner follows its programmed logic regardless of what it finds. High. The tester adapts their approach continuously based on discoveries — each finding opens new avenues of investigation.
Reporting Automated report: list of CVEs, CVSS scores, generic remediation guidance. Often hundreds of pages of scanner output. Manual report: narrative of testing activities, validated findings with proof of exploitation, attack path analysis, business impact assessment, prioritised remediation roadmap.
Frequency Weekly, monthly, or quarterly — designed for continuous or frequent execution. Annually at minimum, plus after significant changes. Designed for periodic deep assessment.
Cost Low to moderate. Can be run in-house with licensed tools. Higher. Reflects the skilled human time, expertise, and manual analysis involved.

What happens when you buy a scan and think it's a test.

The confusion between vulnerability scans and penetration tests is not merely academic. It leads to concrete, measurable harm — security decisions made on incomplete information, budgets allocated based on false assumptions, and organisations that believe they have assessed their security posture when they have only scratched the surface.

False Confidence from False Assurance
The organisation receives a vulnerability scan report with no critical findings and concludes its systems are secure. The board is told the annual penetration test found nothing significant. In reality, no penetration test was conducted. The scanner found no known vulnerabilities with critical CVSS scores — but it did not test application business logic, did not attempt to chain medium-severity findings into attack paths, did not test authentication mechanisms against credential stuffing or brute force, did not assess whether session tokens could be stolen via cross-site scripting, and did not evaluate whether an attacker with a valid low-privilege account could escalate to administrative access. The absence of critical CVEs does not mean the absence of critical risk — it means the scanner did not find known vulnerabilities with high CVSS scores. That is a very different statement.
Missed Attack Chains
A vulnerability scanner reports three separate medium-severity findings: a web application with verbose error messages that disclose internal paths, an IDOR vulnerability that allows horizontal privilege escalation between user accounts, and a file upload function that does not properly validate file types. Each finding individually scores Medium on the CVSS scale. The scanner reports them as three unrelated medium findings. A penetration tester would chain them: the error messages reveal the upload directory path, the IDOR allows access to another user's upload function, and the file upload accepts a web shell — resulting in remote code execution on the server. Three mediums become a critical compromise. The scanner will never make this connection. The tester will.
Compliance Without Security
Some compliance frameworks require 'penetration testing' — PCI DSS Requirement 11.4, for example. An organisation that submits a vulnerability scan report as evidence of penetration testing may satisfy a superficial audit, but it has not met the intent of the requirement, has not achieved the security assurance the requirement is designed to provide, and is at risk if a qualified assessor examines the evidence closely. More importantly, it has not tested its defences against the threats that the compliance requirement exists to address. Compliance achieved through inadequate testing is compliance in name only — it provides regulatory cover without providing security.
Budget Misdirection
An organisation that pays for a vulnerability scan and believes it received a penetration test has set its budget expectations at the wrong level. When it eventually needs a genuine penetration test, the cost appears disproportionate compared to what was paid previously — creating resistance to investment in the deeper assessment that is actually needed. The £2,500 'penetration test' that was actually a vulnerability scan has not saved money — it has wasted it, because the organisation now has a report that provides neither the depth of a penetration test nor the actionable vulnerability management data of a properly configured and continuously run scanning programme.
Remediation Without Prioritisation
A vulnerability scan report for a medium-sized network might contain 500–2,000 findings. Without manual analysis, attack path mapping, and business context, the remediation team is left to prioritise solely by CVSS score — fixing Critical before High before Medium before Low. This approach frequently results in patching a critical vulnerability on an isolated test server before addressing a medium-severity issue on the internet-facing payment system, because the CVSS score does not account for the asset's business value, its exposure, or how the vulnerability combines with other findings. A penetration test report, by contrast, prioritises findings by actual exploitability and business impact — telling the remediation team what to fix first based on what matters, not what scores highest.

The same target, two very different outcomes.

To make the distinction concrete, consider a single web application — a customer portal for a financial services company — assessed first by a vulnerability scanner and then by a penetration tester.

Vulnerability Scan Output — Customer Portal
# Automated scan completed in 3 hours 42 minutes
# Targets scanned: 1 web application, 247 pages crawled

CRITICAL:
HIGH: 2
H-001: jQuery 3.4.1 — CVE-2020-11022 (XSS via htmlPrefilter)
H-002: Missing Content-Security-Policy header
MEDIUM: 5
M-001: Cookie without Secure flag
M-002: Cookie without HttpOnly flag
M-003: X-Frame-Options header not set
M-004: Server banner disclosed (nginx/1.20.2)
M-005: Directory listing enabled on /assets/
LOW: 8
INFO: 12

# Overall assessment: No critical vulnerabilities detected.
# Recommendation: Remediate high and medium findings.
Penetration Test Findings — Same Customer Portal
# Manual testing: 8 days by senior consultant
# Scope: Full application assessment including business logic

CRITICAL: 2
C-001: IDOR — change account_id parameter in /api/statements
Any authenticated user can download any other user's
financial statements. 34,000 customer records exposed.
Scanner did not find this — requires authentication
and manual parameter manipulation.

C-002: Broken access control — password reset token is
sequential (reset_token=4521, 4522, 4523...). Attacker
can enumerate tokens and reset any user's password.
Combined with C-001, enables full account takeover
of any customer account. Scanner cannot detect
sequential token patterns — requires human analysis.

HIGH: 3
H-001: Stored XSS in support ticket 'subject' field.
Payload executes in support agent's browser when
viewing ticket — enables session hijacking of
internal support staff accounts with access to
all customer records. Scanner found jQuery CVE
but missed the actual exploitable XSS.

H-002: Session tokens do not invalidate on password change.
After account takeover via C-002, legitimate user
changing password does not terminate attacker session.

H-003: API rate limiting absent on /api/auth/login endpoint.
Credential stuffing attack successful — 2,100 valid
credential pairs confirmed from public breach data
in under 4 hours.

MEDIUM: 4 (including 2 confirmed from scanner, 2 new)
LOW: 3

# Attack chain: C-002 → C-001 → H-001 → H-002
# Reset any password → access any account → steal
# support agent session → access all customer data
# → attacker retains access even after password change

# Business impact: Full compromise of 34,000 customer
# financial records. Reportable breach under FCA/GDPR.
# Estimated regulatory exposure: £2.5M–£8M.

The vulnerability scanner reported zero critical findings. The penetration tester found two critical vulnerabilities, three high-severity issues, and an attack chain that enables full compromise of 34,000 customer accounts with estimated regulatory exposure measured in millions. Every critical and high finding discovered by the penetration tester was invisible to the scanner — because they required authentication, manual parameter manipulation, business logic analysis, or creative chaining that automated tools cannot perform. The scanner was not wrong in what it reported. It was simply unable to find what mattered.


Both have a role — if you use them correctly.

Vulnerability scans and penetration tests are not competing alternatives — they are complementary activities that serve different purposes within a security programme. The question is not 'which one should we do?' but 'how do we use both effectively?'

Use Case Right Tool Why
Continuous monitoring of patch levels across the estate Vulnerability scan — weekly or monthly Scans provide the breadth and frequency needed for ongoing vulnerability management. You want to know quickly when a new critical CVE affects your systems.
Understanding what an attacker could actually achieve against your web application Penetration test — annually or after significant changes Only manual testing can assess business logic, chain findings, and demonstrate real-world impact. A scan tells you about known CVEs; a test tells you about exploitable risk.
Validating that last month's patches were applied correctly Vulnerability scan — targeted rescan A focused rescan of previously identified vulnerable hosts confirms whether remediation was effective. Quick, automated, and repeatable.
Testing whether your SOC would detect a real intrusion Penetration test or red team engagement Detection and response can only be tested by a human adversary operating covertly. A scanner does not test your SOC — it tests your patch management.
Meeting PCI DSS quarterly external scanning requirement ASV vulnerability scan — quarterly PCI DSS Requirement 11.3.2 specifically requires quarterly external vulnerability scans by an Approved Scanning Vendor (ASV). This is a scan requirement, not a pen test requirement.
Meeting PCI DSS annual penetration testing requirement Penetration test — annually PCI DSS Requirement 11.4 requires annual penetration testing that tests from both inside and outside the network. A vulnerability scan does not satisfy this requirement.
Assessing a new application before go-live Both — vulnerability scan for known issues, then penetration test for everything else The scan provides a quick baseline of known issues. The penetration test assesses application security in depth — business logic, authentication, access control, input validation, and attack resilience.
Establishing a vulnerability management baseline for a new environment Vulnerability scan — comprehensive authenticated scan An authenticated vulnerability scan across the full environment provides the inventory and baseline needed to build a vulnerability management programme.

How they work as part of a mature security programme.

In a mature security programme, vulnerability scanning and penetration testing operate as complementary layers — each addressing the limitations of the other.

A Mature Security Testing Programme
vuln_scan --scope=full-estate --frequency=weekly # Continuous visibility into known vulns
vuln_scan --scope=external --frequency=quarterly --asv # PCI ASV compliance scanning
vuln_scan --scope=new-deployments --trigger=deploy # Scan before anything goes live
pen_test --scope=web-apps --frequency=annual # Deep manual testing of applications
pen_test --scope=internal-network --frequency=annual # Internal network compromise assessment
pen_test --scope=external --frequency=annual # External perimeter assessment
pen_test --trigger=significant-change # Test after major infrastructure changes
red_team --frequency=biennial # Full adversary simulation (mature orgs)
retest --trigger=remediation-complete # Verify fixes after every engagement

Vulnerability scanning provides the continuous, broad monitoring that catches new vulnerabilities as they are published and ensures patch management is functioning. Penetration testing provides the periodic, deep assessment that reveals the vulnerabilities scanning cannot find, validates whether identified vulnerabilities are actually exploitable, maps attack chains, and produces the business-contextualised risk understanding that drives strategic security investment. Neither replaces the other. Both are necessary. The organisation that only scans has breadth without depth. The organisation that only pen tests has depth without continuity. The organisation that does both, at the right frequency and with the right scope, has a security testing programme that actually reflects its risk.


Red flags that you're buying a scan marketed as a test.

If you are commissioning security testing and want to ensure you receive a genuine penetration test rather than a repackaged vulnerability scan, look for these indicators.

Duration and Effort
A penetration test of any meaningful scope takes days, not hours. If a provider is offering to 'penetration test' your web application in a single day, or your entire network in two days, you are almost certainly being offered a vulnerability scan with minimal manual review. Ask how many person-days of testing are included and what the tester will be doing during each day.
The Report
A vulnerability scan report is predominantly automated output — a long list of CVEs with CVSS scores and generic remediation text. A penetration test report contains a narrative: what the tester did, what they found, how they exploited it, what they could access, how findings chain together, and what the business impact is. If the report you receive reads like machine output with no human analysis, you received a scan. Ask for a sample report before commissioning.
Named Testers with Credentials
A genuine penetration test is performed by named individuals with relevant qualifications and experience — CREST CRT/CCT, OSCP, OSCE, CHECK Team Leader, or equivalent. Ask who will be testing and what their qualifications are. If the provider cannot name the individual tester or describe their experience, the work may be performed by a junior analyst running a scanner.
Price
Penetration testing is a skilled professional service. A qualified tester's time has a cost. If the price quoted is significantly below the market rate for the scope described, the provider is either cutting corners on tester quality, allocating fewer days than the scope requires, or delivering a vulnerability scan rather than a penetration test. The cheapest quote is very rarely the best value — and in security testing, inadequate testing is worse than no testing, because it creates false confidence.
Methodology Discussion
A competent penetration testing provider will discuss methodology during scoping — what testing approach they will use, what areas they will focus on, what tools and techniques are relevant to your environment, and what the rules of engagement should cover. If the scoping conversation consists entirely of 'how many IP addresses do you want scanned?', you are buying a scan.

The bottom line.

A vulnerability scan is an automated tool that identifies known vulnerabilities by comparing system configurations against a database of published issues. It provides breadth, speed, and repeatability — essential qualities for continuous vulnerability management. It does not exploit vulnerabilities, does not assess business logic, does not chain findings into attack paths, and does not provide the business-contextualised risk understanding that security decision-makers need.

A penetration test is a skilled, human-led assessment that actively attempts to compromise systems using the same techniques a real attacker would employ. It provides depth, creativity, validation, and contextual analysis — essential qualities for understanding genuine security risk. It is slower, more expensive, and covers less ground than a scan — because it is doing fundamentally different and more complex work.

Both are valuable. Both are necessary. Neither replaces the other. The danger lies in confusing them — in buying a vulnerability scan and believing you have had a penetration test, in presenting scan results to the board as evidence of security assurance, or in building your security programme on the assumption that the absence of critical CVEs means the absence of critical risk. If your security testing programme includes only vulnerability scans, you have continuous visibility into known weaknesses but no understanding of what an attacker could actually achieve. If it includes only penetration tests, you have periodic deep insight but no continuous monitoring between engagements. A mature programme uses both — vulnerability scanning for breadth and continuity, penetration testing for depth and validation — and ensures that the people commissioning, conducting, and consuming the results understand exactly what each one does, what it does not, and why the distinction matters.


Know the difference. Get the depth.

Our penetration tests are conducted by named, qualified consultants who manually test, exploit, and report with full business context. We do not sell vulnerability scans as penetration tests — and we are happy to explain exactly what you will receive before you commission.