Reader Question: Is Our Vulnerability Scan the Same Thing as a Penetration Test?

This question keeps turning up in r/msp and r/sysadmin threads, and it gets sharper every time a customer or an insurer asks for a penetration test report and the only document in the drawer is a scan from eleven months ago. It is also the first question we get from business owners who have never bought either.

The short answer is no, they are not the same thing, and the difference is not academic. One produces a list. The other produces evidence that somebody got from the outside to something that matters. Confusing the two is how a company ends up with a clean quarterly report and a very bad Tuesday.

Here is the version you can read in five minutes, plus the questions that tell you which one you are actually buying.

What a vulnerability scan actually does

A scan is automated. A tool connects to your systems, asks them what software they are running, compares the answers against a database of known vulnerabilities, and hands back a list sorted by severity. It is fast, it is repeatable, and it is genuinely useful. Run it often enough and it will catch the unpatched thing you forgot about, which is how most of these conversations start.

It also has a hard ceiling. A scanner only finds what it already knows how to recognise. It cannot tell you that three medium findings, chained together, hand an attacker domain administrator. It cannot tell you that a portal the tool rated low sits on the same subnet as your accounting server. It cannot tell you that your help desk will reset a password for anyone who calls and sounds tired.

If you take card payments, this part is not optional. PCI DSS v4.0.1 requires external vulnerability scans by an approved scanning vendor at least quarterly, and internal scans quarterly as well, which since March 2025 have to be authenticated so the tool can actually see inside the host instead of guessing from the outside.

What a penetration test actually does

A test is a person, or a small team, trying to get in the way an attacker would. They start from a defined position, usually the internet with no credentials, and they work the way a real intrusion works: look around, find the soft spot, get a foothold, escalate, and see how far the access goes before anyone notices.

The deliverable is not a severity list. It is a narrative with evidence: the starting point, each step, what it gave the tester, how long it took, and whether anything detected it. That last part is the one owners skip and the one that matters most, because a test that reaches your file server in forty minutes and trips nothing is telling you something a scan never will.

The methodology side is settled. NIST SP 800-115 has defined the planning, execution and reporting phases since 2008, and PTES covers the same ground in more operational detail. If a provider cannot describe which of those they follow, the conversation is over.

PCI DSS draws the same line. Requirement 11.3 covers scanning, on a quarterly clock. Requirement 11.4 covers penetration testing, at least once every twelve months and again after any significant change, from both outside and inside the network. Two requirements, two different activities, one standard.

Why the gap has teeth this year

For nineteen years, stolen credentials were the most common way breaches started. That changed. Verizon's 2026 Data Breach Investigations Report, published in May, found exploitation of unpatched vulnerabilities was the top access vector at 31 percent of breaches, with credential abuse down at 13 percent.

The same report shows why. The median time to fully patch rose to 43 days from 32. Organizations patched only 26 percent of the flaws on CISA's Known Exploited Vulnerabilities catalog in 2025, down from 38 percent the year before. That catalog held 1,768 entries as of November 4, 2026, with 284 of them added this year alone.

So the list a scanner produces is longer and more urgent than it was two years ago, and the time you have to act on it is shorter. A quarterly scan report that nobody triages is now a fairly expensive way to be wrong on a schedule.

The uncomfortable middle

There is a third category, and it is where most disappointment lives: the thing sold as a penetration test that is really an automated scan with a nicer cover page. It happens because the buyer cannot tell the difference, and because the words are used loosely by nearly everyone in the industry, including some of the people selling it.

The tell is often in the scoping call. A real test needs a defined starting position, a named target set, and a conversation about what is out of bounds because it would take down production. A scan needs an IP list. If nobody asks you where the tester should start, there is no tester.

A scan is a smoke alarm. Useful, cheap, and it tells you a fire exists somewhere. A test is a person walking your building at night, trying the doors, and writing down which one opened. One is a notification. The other is a finding.

Nobody is served by buying the alarm and believing they hired the walker.

Five questions that settle it

Ask any provider these before you sign anything, and you will know what you are buying in about four minutes.

One: will a human attempt to exploit what they find, or will the tool just report it? Two: what is the starting position, and does it match how an attacker would actually reach you? Three: if you chain two low findings together and get somewhere serious, will the report show that chain? Four: will you tell me what the test looked like from the defender's side, including what you did that nobody saw? Five: will you retest the fixes, and what does that cost in hours?

If the answers are vague on any of the first four, you are looking at a scan with better marketing.

One more worth asking, because it changes the value of the report: will the findings be written for the person who has to fix them, or for the person who has to file them? A report full of tool identifiers and severity scores gets filed. A report that says which door opened, in what order, and what closed it gets fixed.

What a sensible program looks like at fifty people

Not a choice between the two. Running both, on different clocks, is the cheap version. Scan continuously or at least monthly, because the catalog grows weekly and your software changes without you. Triage what the scan returns against what is actually being exploited, not against a severity number alone. Then buy one real test a year, aimed at the thing that would actually end your week: the customer portal, the remote access, the finance mailbox.

The cost shape is different too, and worth planning for. Scanning is a tool subscription plus somebody's attention. Testing is a person for a week, sometimes two, and it lands as a line item rather than a monthly charge. Budget for the test annually the way you budget for an audit, because for many businesses that is what it is functioning as.

Then fix and retest. A test whose findings sit in a report until next year's test is a subscription to the same bad news.

The scan tells you what is broken. The test tells you what that costs you. You want both answers, and they are not the same purchase.

Sources

• Verizon, 2026 Data Breach Investigations Report, coverage and figures via SecurityWeek, May 19, 2026: https://www.securityweek.com/verizon-dbir-2026-vulnerability-exploitation-overtakes-credential-theft-as-top-breach-vector/
• CISA, Known Exploited Vulnerabilities catalog, version 2026.11.04, 1,768 entries: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• PCI Security Standards Council, PCI DSS v4.0.1, Requirement 11.3 (vulnerability scanning) and Requirement 11.4 (penetration testing), summary via ServerScan: https://www.serverscan.com/pci-dss-requirement-11-testing-security-systems
• NIST, SP 800-115 Technical Guide to Information Security Testing and Assessment, September 2008: https://csrc.nist.gov/pubs/sp/800/115/final
• Trending question source: recurring r/msp and r/sysadmin threads on pen test versus vulnerability scan, and vendor-side discussion of customers asking for a pen test report where only a scan exists: https://www.reddit.com/r/msp/