"Penetration test" has become a box on a compliance form, which means a lot of what is sold under that name is really an automated scan with a nicer cover page. The two do different jobs, cost very different amounts, and answer different questions. Buying the wrong one wastes money either way.
A scan finds known holes. A test finds what an attacker would do with them.
A vulnerability scan runs a tool against your systems and lists the weaknesses it recognises — missing patches, weak configurations, exposed services. It is fast, cheap, and worth running often. What it cannot tell you is whether those weaknesses actually chain together into a way in, or whether they matter given how your systems are set up.
A penetration test puts a human in the attacker's seat. They take the findings a scanner produces, discard the ones that are noise, and try to actually reach something valuable — customer data, a payment system, domain admin. The deliverable is not a list of every weakness; it is the story of how far someone could get, and what to fix first to stop them.
When a scan is enough
- You want ongoing hygiene between bigger assessments.
- You are checking that last month's patches actually landed.
- Your environment is small and you mainly need to catch obvious misconfigurations.
When you need a real test
- You handle money, health data, or personal information at scale.
- A customer, regulator, or ISO 27001 / SOC 2 auditor is asking for one specifically.
- You have just launched something new — an app, a portal, a cloud migration — and need to know it is safe before real users arrive.
- You want to know not just what is wrong, but what an attacker would reach if they got in.
Questions to ask whoever is selling you one
The answers separate a genuine engagement from a re-badged scan:
- Who writes the report — a person or the tool? If findings come straight out of software, you are buying a scan.
- Will you manually verify findings and remove false positives? A real test does; a scan hands you the raw list.
- Do you retest after we fix things? A closed finding you cannot prove is closed is not much use to an auditor.
- Who will I actually talk to? You want the engineer who did the work walking your team through it, not a sales handoff.
If you are not sure which you need, that is a normal place to start. Tell us what you are protecting and why you are asking, and we will tell you honestly whether a scan covers it or a full test is worth the spend.