Penetration test vs vulnerability scan: the real difference
A vulnerability scan is an automated check for known weaknesses: fast, cheap to repeat, and full of findings that may not matter. A penetration test is a manual attack by people who prove which weaknesses are exploitable, chain them, and find the flaws a scanner cannot recognise, such as broken authorisation and business logic. You need scans continuously and a penetration test when the answer has to be definitive.
Enterprise only. Cyber security is the one service ITovio offers at enterprise level: established companies and enterprises with production systems worth attacking properly. We do not sell low-budget scans or small-business security packages.
- Buyers comparing quotes that both say "penetration test".
- Teams whose customer asked for a pen test and received a scanner report.
- Security leads deciding what to run continuously and what to buy once a year.
Definitive results, not maybes
Proven, not suspected
Every finding in the report is exploited by hand and shipped with a working proof of concept, reproduction steps and evidence. No unverified scanner output, no "potential" issues padding the page count.
Ranked by business impact
Severity is scored with CVSS and then argued in plain language: what an attacker reaches, which data, which customers, what it would cost you.
Closed means closed
After you fix, we attack the same issue again. The retest report states, per finding, whether it is closed, partly closed or still open.
A clean result is still a result
If a target holds, the report says exactly what was attacked, how and for how long, so "nothing exploitable found" is evidence you can hand to a customer, auditor or board.
Side by side
| Vulnerability scan | Penetration test | |
|---|---|---|
| Who does it | Software | Experienced testers, using software for coverage |
| What it finds | Known vulnerabilities and misconfigurations with a signature | Exploitable weaknesses, including authorisation, business logic and chained attacks |
| Proof | Reports possible issues | Proves each finding with a working proof of concept |
| False positives | Common, left for you to triage | Removed before the report; only proven findings remain |
| Context | Generic severity | Severity argued from your data, users and business |
| Frequency | Continuously or weekly | Per major change, and at least yearly for critical systems |
| Accepted as evidence | Rarely, by serious customers and auditors | Yes, when the report shows method, scope and proof |
How to tell which one you were sold
- The report has hundreds of findings with generic descriptions copied from a plugin database.
- No finding has screenshots, requests or reproduction steps specific to your system.
- Nothing about access control between your users or tenants is mentioned.
- The test took a day, and nobody asked for test accounts.
- No retest is offered, or the retest is the same scan run again.
Use both, for different jobs
Continuous scanning catches known issues between tests and is worth running permanently. A penetration test answers a different question: can someone actually get in, and how far would they get. Neither replaces the other, and only one of them should carry the words "penetration test" on the cover.
Asked before most engagements
Is a penetration test better than a vulnerability scan?
Why are penetration tests more expensive?
Do you run scans as well?
Reviewed by the ITovio security team on 3 November 2026.
Related
What is in our penetration test report
Read itGuideHow to scope a penetration test
Read itServiceWeb application penetration testing
Read itGuideWhat attackers exploit in 2026, and what we test for
Read itAll specialist testing: Web application testing, API testing, Cloud testing, Network and Active Directory, Mobile app testing, AI and LLM testing, Red team and attack simulation.
Find out what an attacker would find first.
A 30-minute scoping call, then a written scope with targets, depth, windows and deliverables before you commit. Enterprise engagements only.
