Penetration Testing vs Vulnerability Scanning? Plain English Answer

A vulnerability scan uses a series of packet captures and requests on a network to identify weaknesses in security controls. A penetration test, on the other hand, involves someone trying to actively exploit the weaknesses in your network just like an attacker would. Many penetration tests start with a vulnerability scan.

That’s the short explanation, let’s look at it in a little more detail.

Vulnerability scanning is actually only one component of vulnerability management – the practice of identifying, prioritizing and resolving vulnerabilities in an environment.
You see:
There’s no way to make any environment completely secure and free of weaknesses.
They will continue to exist.
And few organizations have a ceaseless budget for implementing security controls.
They have to prioritize which ones they should deal with first.
These are all things that must be considered as a part of vulnerability management.
Let’s take a look at the components of vulnerability management starting with vulnerability scanning.

What is vulnerability scanning?

Vulnerability scanning is a process in which a security professional uses a combination of automated tools and manual processes to determine all of the weaknesses in an organizations systems. These are weaknesses that could lead to compromises of the organization’s infrastructure.

It is a kind of security audit.
Unlike penetration testing, the person performing the vulnerability scan does not attempt to actually exploit those vulnerabilities.
They simply want to identify them so they can resolve them.
A vulnerability scan might look something like this:

As you can see, vulnerability scanning is a “light touch” security assessment that can be automated with the right tools.
In fact, because of how easy it is to do, and how beneficial the results, most small and medium enterprises should look into vulnerability management tools.
Many of these tools can perpetually run on your network and notify the IT team when an unauthorized change has been made.
This can be especially useful for understaffed IT and security teams.

Penetration testing is completely different from vulnerability scanning.
Here’s how:
When an organization performs a penetration test, they are looking to simulate a real attack.
The penetration testers think and act like criminal attackers.
They are looking for a way to get into the systems and get access to the systems or data that would cause harm to the organization.
What’s the benefit of this?
Well, if the testers are able to identify how they would do it before the bad guys get to it, the organization is able to remediate the weaknesses.

Now,
Penetration tests are completed in phases.

During the early phases of the test, when the pen testers are looking for ways into the systems, they may very well use a vulnerability scanning tool.
And this is why penetration testing vs vulnerability scanning is so different.
The penetration test keeps going.
Once the vulnerabilities are identified, ways are found to exploit those weaknesses.

Because of the difference in the nature of the data provided, penetration tests and vulnerability scans are typically performed at different frequencies.
A penetration test typically occurs once a year and last for a few days, while a vulnerability scan may take only a few hours.
However, many organizations are beginning to understand the benefit of managing vulnerabilities and are beginning to incorporate it into their infrastructure.
They constantly have vulnerability scans running to identify changes in the network and new threats.
I think this is a great approach.

So, now that you understand the difference in the two types of testing, let’s look at those differences side by side in this graphic.

Frequency – vulnerability scans occur at least quarterly and sometimes perpetually, while penetration tests only occur once or twice a year or any time there is a significant change in the organization.

Reports – vulnerability scan reports provide a comprehensive view of existing vulnerabilities and changes since the last scan, while penetration test reports identify data compromised and the methods used to do so.

Focus – vulnerability scans focus on software and configuration vulnerabilities that could be exploited while penetration tests focus on showing unknown but exploitable weaknesses in business processes

Who performs – vulnerability scans are usually completed by staff at the organization while penetration tests are done by an outside party

Benefit – vulnerability scans identifies ways that equipment could be compromised while penetration tests identify and reduce weaknesses

While vulnerability scans and penetration testing are both important and beneficial parts of an organizational cybersecurity program, they are very different.
As we discussed, vulnerability scans are more of a light touch approach.
The scan is intended to identify weaknesses in systems.
Penetration tests, on the other hand, are more disruptive.
The tester is seeking to compromise a system just like an attacker would.
Both types of tests have their place in an organization’s security programs.