Penetration test vs vulnerability scan: what’s the difference?

Vulnerability scan

An automated tool checks your website against a database of known issues — outdated software, missing headers, common misconfigurations. It’s fast and repeatable, but it can’t understand how your application is meant to work, and it often reports false positives.

Penetration test

A tester (increasingly assisted by AI tooling) actively tries to break in the way an attacker would: chaining small issues together, testing business logic, and checking whether one customer can see another’s data. Findings are confirmed and explained, with practical fixes.

Side by side

• Scans find known issues; pentests also find logic and access-control flaws
• Scans produce long raw lists; pentests produce prioritised, verified findings
• Scans can run weekly; pentests are usually yearly or after major changes
• Pentests need ownership verification, agreed scope and written authorisation

Which do you need?

Ideally both: regular scanning to catch new known issues, and a penetration test to find what scanners miss — especially if you handle logins, payments, personal data or AI features. Customers, insurers and frameworks such as Cyber Essentials Plus or ISO 27001 increasingly expect evidence of testing.

A low-risk first step

Our complimentary AI pentest gives you a focused, verified view of your site’s security with no payment or obligation. If you need more depth, we can quote for a full penetration test.