What is the difference, in short?
| Compared on | A vulnerability scan | A penetration test |
|---|---|---|
| Who does the work | An automated tool, set up by a person | A tester, by hand, with tools in support |
| What it looks for | Known flaws: outdated software and common misconfigurations | Access control, business logic and small flaws that chain together |
| What comes back | A list of possible issues to verify | Findings proved with a working exploit, each with a fix |
| Best at | Breadth and frequency across many hosts | Depth on the systems that matter most |
| The right tool when | You need many low-risk hosts checked often | You need to know what an attacker could reach |
What does a vulnerability scan find?
A scanner compares what it can see against a large catalogue of known weaknesses. It is good at spotting software with published vulnerabilities, services exposed that should not be, weak encryption settings, missing security headers and default configurations.
Its strength is coverage. A scanner can check many hosts on a schedule and flag a new problem soon after it appears. Its limit is understanding. It does not know that invoice 1043 belongs to another customer, that a discount should apply only once, or that a support role should never reach the admin export. It reports what matches a pattern, and some of what it reports will not be exploitable in your setup, so each result needs checking by a person.
What does a penetration test find that a scan usually misses?
A tester looks for the flaws that depend on how your product is meant to work. The common ones:
- Access between users: one customer reading another's data by changing an ID in a request.
- Business logic: a checkout that accepts a changed price, or an approval step that can be skipped.
- Chained flaws: three issues that each look minor, which together give an attacker an admin session.
- Sign-in edge cases: password reset, email change and session handling that work in the screen but fail on the server.
These rarely match a signature, because each request looks normal. The way to find them is to use the product as each role and ask, at every step, what the server allows that it should not.
When is a scan enough?
A scan is enough when breadth matters more than depth. For a large estate of standard hosts that hold little sensitive data, scheduled scanning and prompt patching cover the most likely problems, more often and with less effort than a manual test.
A scan is also the right tool between tests. Run on a schedule, it catches a newly published vulnerability in software you run without waiting for the next test.
When do you need a penetration test?
When the question is what an attacker could actually do. In practice, that means any system where:
- customers sign in and see data that must stay theirs
- money moves, or approvals and limits apply
- several tenants share one platform
- an API is called by apps or partners you do not control
- an AI feature can read data or call tools
A clean scan of these systems says little about the flaws that matter most in them, because those flaws live in the logic, not in a version number.
What does each report look like?
A scan report is usually a long list grouped by severity, with a reference and general advice for each item. Your team then works out which items are real.
A penetration test report is shorter and heavier. Each finding is one confirmed problem with the proof that shows it: the request the tester sent, the response that came back and what it exposed. It states the business risk in plain language and gives a fix written for the engineer who owns the code. Here is a sample finding in full.
How do scans and tests fit together?
Use both, for different jobs. Scan often and widely to catch known flaws early. Bring the systems that hold customer data or money to a tester, so the flaws a scanner cannot see are found and proved. After a test, fix the findings, retest them, and let the scanner keep watch until the next test.
GreySurface runs the second half: human-led, AI-assisted penetration tests in which a tester works each lead by hand and every finding comes with proof of exploit, the business risk and a fix. See penetration test types, or start with what a penetration test is.