The Difference Between Vulnerability Scans and Pen Tests

Most businesses know they need some form of security testing. Where it gets confusing is choosing between a vulnerability scan and a penetration test, because at first glance, they look like they do the same job: find weaknesses in your systems.

They’re very different, though, and take different amounts of money, time, output, and depth. Let’s take a look at each one, its real-world applications, the shortcomings, the expense, and how to determine which mix works best for your business.

What a Vulnerability Scan Actually Does

A vulnerability scan is automatically performed. You take a tool to your network, applications, or cloud environment, and it scans your environment against a database of known issues and identifies an issue if one is found. Outdated software, not applying patches, weak configurations, default passwords not changed. That sort of thing.

Scans are pretty quick. Most finish within an hour or two, and you can run them weekly or daily with little impact on your team. They are inexpensive as well, so they work great when you’re monitoring over the long term. However, they do not go deep. A scanner operates according to a set of rules and nothing else. It won’t link up two minor findings to determine how they might help create a serious breach, and it simply won’t determine if a real person could exploit what it flagged.

What a Pen Test Brings to the Table

A pen test is a practical test. A trained tester or even a whole team will actively attempt to compromise your systems in the same way that they would be compromised by an actual attacker. They’ll search for any logic errors, send phishing emails to your employees to see who answers, try to work their way up your network, and log on to any other accounts they can find to gain access.

This type of thing is impossible to detect by a scanner. Web application logic bugs that only come into play when combined with another bug, misconfiguration that becomes a problem when combined with another bug, or bugs in your web application team’s “process” when things go wrong. Typically, pen tests are conducted annually or whenever there are significant changes in your infrastructure. These are more expensive and more time-consuming, usually 1-3 weeks, but you will receive a detailed report with evidence of proof-of-concept supporting all findings.

How Compliance Frameworks Treat Each One

Regulators don’t view scans and tests as synonymous. PCI DSS is a good example of this. It requires quarterly vulnerability scans carried out by an approved vendor and an annual penetration test. Cyber Essentials Plus builds a vulnerability assessment into its verification process too. It’s important to note that ISO 27001 and PCI DSS are clear that doing one does not protect you from the other.

Why You’ll Want Both

Scans are run over a broad area, and you can do a scan as often as you want. Pen tests delve deeper and reveal what an attacker might be able to achieve with the vulnerabilities found by the scans. Constant scanning identifies new problems as they arise, and an annual pen test shows how those problems could link into an actual attack.

Some providers, like Omni Security (omnicybersecurity.com), deliver both automated scanning and CREST-accredited manual testing under one roof, so everything feeds into a single remediation plan instead of two separate reports that don’t talk to each other.

How to Decide What You Need First

Start with regular vulnerability scans for small businesses with limited IT resources. They provide a starting point and help you eliminate the low-hanging fruit. After this is running, allocate funds for a pen test at least once a year, or more frequently if you are dealing with sensitive customer information, payments, and/or are preparing for a compliance examination.

If you are a larger organization or work in a regulated industry, then you will need both from the outset. Your scans ensure that you’re held in check between tests, while the pen test reveals if you’d be able to withstand an actual attack.

In a Nutshell

Don’t think of scans vs tests. They address entirely different queries. A vulnerability scan informs you of what is exposed at this time, whereas a pen test informs you of what someone could do with that exposure. If you don’t, you’ll have blind spots you were unaware of. Do both on a regular basis, and you will have a much better idea of where your real risks are.