Vulnerability Scan vs Penetration Test: Which Do You Need?

A customer’s security questionnaire asks, “Do you perform regular penetration testing?” Your IT provider says you already run vulnerability scans. Are those the same thing? Not even close, and mixing them up can cost you a deal, a failed audit or a false sense of safety.

Both tests look for weaknesses before attackers find them. The difference is depth. A scan tells you which doors might be left open. A penetration test sends someone to try every handle, walk through the open ones and show you what they could reach. This guide compares the 2, explains what common compliance frameworks expect and helps you scope the right test for your budget.

The quick difference

A vulnerability scan is automated software that checks systems against a database of known vulnerabilities, missing patches and misconfigurations. It’s broad, fast and repeatable. It produces a list, often a long one, ranked by severity.

A penetration test (pen test) is a manual, goal-driven exercise. Qualified testers use tools plus human judgment to exploit vulnerabilities, chain weaknesses together and prove what an attacker could actually achieve, like reaching customer data or taking over an admin account.

Think of it this way: the scan asks “what might be wrong?” The pen test asks “what can someone actually do with it?”

Side-by-side comparison

Key takeaway: Scans keep you current between tests. Pen tests prove whether your defenses actually hold. You don’t choose one forever. You use scans constantly and pen tests periodically.

What a vulnerability scan does well, and where it falls short

Strengths:

• Catches missing patches and outdated software quickly.
• Covers lots of systems cheaply and repeatedly.
• Gives a measurable trend: are high-risk findings going down?
• Many tools support authenticated scanning, logging in to check systems from the inside for a more accurate picture.

Limits:

• Finds only what it has signatures or checks for.
• Produces false positives that someone must review.
• Can’t judge business context, such as whether a “medium” finding exposes your payment database.
• Misses business logic flaws, like a web app that lets one customer view another’s invoices by changing a number in the URL.

There are 2 main types: external scans of internet-facing systems such as your website, VPN and firewall, and internal scans of devices and servers inside your network. US critical infrastructure organizations and state and local governments can get free external vulnerability scanning from CISA’s Cyber Hygiene service, which provides weekly reports.

What a penetration test does well, and where it falls short

Strengths:

• Validates which findings are truly exploitable.
• Chains small issues into realistic attack paths.
• Tests people and processes too, if in scope, such as phishing or physical access.
• Produces evidence that customers, auditors and insurers trust.

Limits:

• A snapshot in time. Your environment changes the day after.
• Limited by scope and days. Anything out of scope isn’t tested.
• Costs much more per engagement than scanning.

Common pen test types include external network, internal network (often simulating an attacker who has already phished an employee), web application, mobile app, cloud configuration, wireless and social engineering. NIST’s Special Publication 800-115 describes the core techniques of security testing and how to plan and run assessments.

What compliance frameworks require

Requirements depend on the framework and your role. Here are the most common in the US. This is general information, not legal advice. Confirm requirements with your assessor or counsel.

PCI DSS (businesses that handle card data)

PCI DSS version 4.0.1, under Requirement 11, separates the 2 clearly:

• Internal vulnerability scans at least once every 3 months and after significant changes, with high-risk and critical findings fixed and rescanned (11.3.1).
• External vulnerability scans at least once every 3 months by a PCI SSC Approved Scanning Vendor (ASV), with a passing result (11.3.2).
• Internal and external penetration testing at least once every 12 months and after significant infrastructure or application changes, by a qualified, organizationally independent tester (11.4.2 and 11.4.3).
• Segmentation testing at least every 12 months for merchants using segmentation, and every 6 months for service providers (11.4.5 and 11.4.6).

Passing a quarterly ASV scan doesn’t satisfy the pen test requirement, or vice versa. Many small merchants that fully outsource card handling have reduced requirements based on their self-assessment questionnaire type. Our PCI DSS guide for small businesses explains how that works.

HIPAA (health care)

The current HIPAA Security Rule requires a risk analysis and ongoing evaluation, but doesn’t name a specific scan or pen test frequency. HHS proposed updates in a notice of proposed rulemaking published in January 2025 that would require vulnerability scanning at least every 6 months and penetration testing at least once every 12 months. As of October 2026, those changes remain a proposal, not a final rule. See our guide on HIPAA compliance for software.

FTC Safeguards Rule (non-bank financial businesses)

Businesses covered by the FTC Safeguards Rule, such as mortgage brokers, tax preparation firms and finance companies, must either continuously monitor their systems or run annual penetration tests plus vulnerability assessments every 6 months, according to the FTC’s business guidance.

SOC 2 and customer questionnaires

SOC 2 doesn’t prescribe a fixed testing schedule, but auditors look for evidence that you identify and address vulnerabilities, and many organizations use annual pen tests plus regular scanning to show it. Enterprise customers also commonly ask for a recent pen test summary. Our SOC 2 compliance guide covers the audit process.

Cyber insurance

Insurers often ask whether you scan for vulnerabilities and patch promptly. Some ask about penetration testing for larger or higher-risk businesses. See cyber insurance requirements.

How much each costs

Pricing varies widely, so treat any quote as specific to your scope.

• Vulnerability scanning is usually a subscription priced by the number of IP addresses, assets or web apps. Some endpoint and managed IT bundles include it. Free and open-source scanners exist but take more expertise to run well.
• Penetration testing is usually a fixed project fee driven by scope: number of IP addresses, applications, user roles, cloud accounts and whether retesting is included. More complex apps and internal tests take more tester days.

To compare quotes fairly, ask each vendor for the scope, the number of testing days, the testers’ qualifications, whether a free retest after fixes is included and a sample report. Our guide to small business cybersecurity costs covers testing in the wider budget.

Which do you need? A simple decision guide

Start with vulnerability scanning if:

• You’ve never tested before.
• You have basic IT and want to find missing patches fast.
• You need quarterly ASV scans for PCI.

Add a penetration test when:

• A customer, partner or contract asks for one.
• You’re pursuing SOC 2, PCI DSS with a pen test requirement or another audit.
• You’re launching or majorly changing a customer-facing web app or API.
• You store sensitive data such as health, payment or financial records.
• You’ve fixed the obvious scan findings. Testing a network full of known holes wastes money because testers will find the easy wins.

Where to start: scoping the right test

1. List your assets. Websites, apps, public IP addresses, cloud accounts, offices and remote access tools.
2. Run a scan first. Fix critical and high findings so a later pen test digs deeper.
3. Identify your driver. Compliance, a customer request, a new product or general risk reduction. This sets the scope.
4. Pick the pen test type. External network and web application tests are the most common starting points for small businesses.
5. Define rules of engagement. Dates, in-scope systems, testing windows, emergency contacts and what’s off-limits.
6. Plan remediation time. Budget staff hours to fix findings, and schedule a retest.
7. Repeat. Keep scanning monthly or quarterly, and pen test at least yearly or after major changes.

If you work with an IT provider, ask whether it can manage scanning and coordinate an independent pen test. Our guide on how to choose a managed IT service provider lists questions to ask. For a broader structure, the NIST Cybersecurity Framework places both activities under identifying and managing risk.

Conclusion

Vulnerability scans and penetration tests answer different questions. Scans are your regular health check, cheap enough to run constantly and good at catching known gaps. Pen tests are a stress test that proves whether an attacker could actually get in and what they could reach. Most businesses should scan continuously and add a pen test yearly or whenever compliance, customers or a major change calls for one.

Sources

• PCI DSS v4.0.1 Requirement 11 text, via Microsoft Learn — internal and external scan frequency, ASV scans, penetration testing and segmentation testing requirements
• HHS: HIPAA Security Rule NPRM fact sheet — proposed 6-month scanning and 12-month pen testing requirements
• FTC: FTC Safeguards Rule, what your business needs to know — continuous monitoring or annual pen tests plus semiannual vulnerability scans
• CISA: Cyber Hygiene Services — free vulnerability and web application scanning for eligible organizations
• NIST SP 800-115: Technical guide to information security testing and assessment — security testing techniques and planning