Briefing
The two terms get used interchangeably in sales material, but they answer different questions. A vulnerability scan is an automated check that lists known weaknesses on your systems: missing patches, exposed services and weak configurations. A penetration test is a time-boxed exercise in which a tester tries to exploit weaknesses to see how far an attacker could get.
For most small offices, continuous or frequent scanning plus prompt patching is the foundation. Penetration testing makes sense when a client, insurer or regulator asks for it, before a major change such as a new network or a cloud migration, or periodically for offices holding sensitive data.
A useful penetration test report explains the path an attacker took, ranks findings by real-world risk and gives fixes you can act on. A long list of scanner output with a new cover page is not a penetration test.
What to do
- Run external and internal vulnerability scans on a schedule and track remediation.
- Prioritize findings that appear on the CISA Known Exploited Vulnerabilities list.
- Commission a penetration test when a contract, insurer or major change calls for one.
- Agree scope, rules of engagement and timing in writing before any test.
- Retest after fixes to confirm they worked.
How to verify
- Ask for the date of your last scan and how many critical findings remain open.
- Ask a tester for a sample report before hiring them.
- Confirm the test scope included the systems you actually care about.
Sources
- NIST SP 800-115, Technical Guide to Information Security Testing and Assessment
- CISA Known Exploited Vulnerabilities Catalog
- CISA, Cyber Hygiene Services
Want help putting this in place? Contact Computer Plus or compare our plans.