We sell penetration tests. We also regularly talk people out of them, at least for now, which sounds like bad business until you understand what a penetration test is actually for. This guide will help you spend on the right thing.
- A vulnerability scan is automated, broad and frequent. It lists known weaknesses. Run it continuously.
- A penetration test is a skilled human who exploits and chains those weaknesses point in time. It tells you what a real attacker would actually achieve.
- If your basics are shaky, start with a security assessment, not a pen test. Fix the list first, then test. Otherwise you are paying premium rates to be told the basics are missing.
Vulnerability scan vs penetration test at a glance
Both have a place. They answer different questions, cost different amounts, and run on different schedules.
| Vulnerability scan | Penetration test | |
|---|---|---|
| What it is | Automated tool | Skilled human |
| Question it answers | ”What known weaknesses exist?" | "What would an attacker actually achieve?” |
| Depth | Broad and shallow | Narrow and deep |
| Chains weaknesses together | No | Yes, that is the point |
| Frequency | Continuous or monthly | Point in time, often annual |
| Relative cost | Low | Higher |
| Best for | Ongoing hygiene | Proving resilience and finding real paths in |
A scan lists known flaws by number. A test chains them into the story of your worst week. You want both, at the right time.
When a penetration test is premature
If the fundamentals are missing, a penetration test mostly documents that the fundamentals are missing, at penetration testing prices. These are the signs you are not ready yet.
In that position, a security assessment finds the same gaps by inspection rather than exploitation, costs less, and produces a prioritised to-do list. Do the list. Then a penetration test becomes genuinely informative. Our guide to the Essential Eight covers most of that baseline.
When a penetration test is the right call
What a good report looks like
You should be able to read the first two pages without a translator. Findings ranked by what actually matters to your business, not by raw severity scores. Each one with the realistic consequence, the evidence, and a scoped fix.
Ask any provider two questions before you engage: who is actually doing the testing, and can we talk to them afterwards? If the answer to either is vague, keep walking.
The honest sequence
Assessment first if the basics are shaky. Fix the list. Then test, with a tester you can talk to.
If you are not sure which step you are at, that is exactly the sort of thing worth a short conversation. Tell us what you are protecting and we will tell you plainly which one you need, including if the honest answer is “not yet.” Talk it through.
