The two get confused constantly, sometimes deliberately. Some vendors sell an automated scan with a nicer report as a "penetration test". They are different services that answer different questions. A scan asks "what known weaknesses exist?" A penetration test asks "what could an attacker actually do with them?"
What Is a Vulnerability Scan?
A vulnerability scan uses automated tools to check systems for known issues: missing patches, outdated software, weak configurations, exposed services, expired certificates. The scanner compares what it finds against databases of published vulnerabilities (CVEs) and assigns a severity.
Scans are fast, repeatable and relatively inexpensive. They produce a lot of findings, some of which are false positives or low priority. The value comes from running them regularly and fixing what matters, which is what vulnerability management means.
What Is a Penetration Test?
A penetration test is a manual, time-boxed assessment by skilled testers who think like attackers. They use scanning tools as a starting point, then:
- Verify which findings are actually exploitable.
- Chain small weaknesses into a serious compromise.
- Test business logic that scanners cannot understand.
- Attempt to reach specific goals, like domain admin or client data.
- Document how they did it and how to fix it.
A scanner might flag a medium-severity issue on a file server. A tester might use that issue plus a weak service account password plus a misconfigured share to reach your payroll data.
How Do They Compare?
| Vulnerability scan | Penetration test | |
|---|---|---|
| Method | Automated | Manual with tools |
| Depth | Broad, shallow | Focused, deep |
| Finds | Known weaknesses | Exploitable paths and business impact |
| Frequency | Continuous to monthly | Annually or after major changes |
| Typical cost | Lower, often subscription | Higher, fixed project fee |
| False positives | Common | Validated by tester |
| Satisfies compliance needs | Partly | Often explicitly required |
Which One Does a Small Business Need First?
Scanning, usually. It is cheaper, finds the obvious problems, and there is little value in paying testers to find missing patches that a scanner would have caught. Once you have a steady scanning and patching process, a penetration test tells you what the scanner cannot.
A reasonable rhythm for a 100-person Canadian company:
- Continuous or monthly internal and external vulnerability scans.
- Fix critical and high findings on internet-facing systems within days, others on a schedule.
- An external and internal penetration test annually.
- A web application test whenever you launch or significantly change a customer-facing app.
- A retest after fixes to confirm they worked.
When Is a Penetration Test Required?
Many frameworks and customers ask for one, including SOC 2 audits, PCI DSS, enterprise vendor questionnaires and some cyber insurers. Check the specific requirement: some ask for an annual external test, some for internal and application testing too.
How Do You Avoid Buying the Wrong Thing?
Ask the provider what percentage of the work is manual, who the testers are, what methodology they follow and whether you get a sample report. If the "pen test" is delivered within a day of kick-off with no tester interviews, it is probably a scan. Our vulnerability management and penetration testing services are scoped separately for that reason. For budgeting, see How much does a penetration test cost in Canada?.