Vulnerability assessment or penetration test: which do you need?

Both appear on the same procurement list and are frequently quoted as if they were the same service at different prices. They are not. One prioritises breadth, the other depth, and the right choice depends on what you already know about your systems.

What a vulnerability assessment does

A vulnerability assessment aims for coverage. It identifies known weaknesses across an agreed scope — outdated components, missing patches, weak configurations, exposed services — primarily using automated tooling, with manual work to validate findings and strip out false positives.

It answers: what known issues exist across our systems right now? That is genuinely useful, particularly the first time anyone looks. It is repeatable, comparatively quick, and gives you a prioritised list to work through.

What a penetration test does

A penetration test aims for depth. A tester works towards a defined objective — reach customer records, escalate to administrator, move between environments — and manually attempts to exploit and chain weaknesses to get there.

It answers a different question: what could an attacker actually achieve? That distinction matters, because individually low-severity findings can combine into a serious attack path that no scanner will report. Business logic flaws in particular are almost never found by automation, because a scanner has no concept of what your application is for.

A scanner tells you the window is unlocked. A penetration test tells you that the unlocked window leads to a room where the keys are kept.

How to choose

If you have never had a security review, start with an assessment. There is no value in paying for deep manual testing to discover you are running components with widely known vulnerabilities — fix the obvious layer first, then look deeper.

• No prior review, or unclear inventory: vulnerability assessment
• Known baseline, handling sensitive data or payments: penetration test
• Significant new application or major release: penetration test before launch
• Regular ongoing hygiene between deeper engagements: recurring assessment
• Contractual or client requirement: check which is specified, they are not interchangeable

What both require from you

Written authorisation from someone empowered to grant it, a clearly defined scope, technical contacts, and agreement on testing windows. Testing systems without permission is unlawful in most jurisdictions. Any provider willing to skip that step is telling you something important about how they work.

What neither will give you

Neither produces a secure system, and neither is permanent. Both are point-in-time exercises against a defined scope. The next deployment can introduce something new. Their value is in showing you where you stand and what to fix first — which is considerably better than assuming.