A vulnerability scan uses automated tools to identify known vulnerabilities and report them. A penetration test is security testing where people mimic real attacks to find ways around your defenses, often chaining several weaknesses. Scans run often and cheaply; penetration tests run less often and need a skilled tester. Most compliance programs expect both.
Key takeaways
- NIST SP 800-115 says scanning identifies known vulnerabilities and notes that it has high false positive rates.
- NIST describes a penetration test as assessors mimicking real-world attacks, often combining vulnerabilities to gain more access than any single one gives.
- The PCI SSC guidance puts scans at least quarterly and after significant changes, and penetration tests at least annually and after significant changes.
- PCI SSC says a scan is not a substitute: the two differ in purpose, method and report.
- Use scans for continuous coverage and a pen test for assurance on scenarios a scanner cannot judge.
Safeguard publishes this guide and sells scanning tools, which are the cheaper half of this comparison. We describe the standards as written and do not claim a scanner replaces a penetration test.
What is the difference between a vulnerability scan and a penetration test?
A scan finds and ranks possible weaknesses. A penetration test shows whether and how they can be exploited. The PCI SSC guidance summarizes the difference in three rows, reproduced here in our words.
| Criterion | Vulnerability scan | Penetration test |
|---|---|---|
| Purpose | Identify, rank and report vulnerabilities that could lead to compromise | Identify ways to exploit vulnerabilities to defeat security features |
| When (PCI guidance) | At least quarterly and after significant changes | At least annually and after significant changes |
| How | Automated tools, usually with manual verification of issues | A manual process that may use scanning or other tools |
| Output | Known vulnerabilities, ranked by CVSS base scores | Verified issues, with how and how far each can be exploited |
| Typical cost driver | Tool or subscription | Tester days |
What does a vulnerability scan actually do?
A scan compares what it sees to a database of known issues. NIST SP 800-115 says scanners identify hosts and their attributes such as operating systems, applications and open ports, and also attempt to identify vulnerabilities. It lists the capabilities as identifying known vulnerabilities and often providing advice on fixing them, and notes high false positive rates.
For software teams the same idea applies to dependencies: a scanner reads a manifest or SBOM and matches package versions against known CVEs. You can try this with the free in-browser scan at gold.safeguard.sh/scan. It needs no login, keeps the file on your machine, and handles up to 100 dependencies.
What does a penetration test do that a scan cannot?
It chains weaknesses and tests how they behave in your actual system. NIST says most penetration tests look for combinations of vulnerabilities on one or more systems that can give more access than a single vulnerability could. It also says a test can show how well the system tolerates real-world attack patterns and how sophisticated an attacker needs to be.
The UK NCSC adds an honest limit: a pen test is assurance over your own vulnerability management, not a primary way of finding vulnerabilities, and it cannot validate security beyond known issues on the day of the test.
Can a vulnerability scan replace a penetration test?
No, not where a framework or customer asks for a penetration test. The PCI SSC guidance treats them as separate requirements with different frequency and different people. Scan output submitted in place of a penetration test is also reported by several compliance guides to fail PCI testing requirements, though those are secondary sources, so confirm with your assessor.
The reverse is also true. A yearly penetration test does not replace continuous scanning, because new CVEs appear every week. The NCSC says a year or more between tests is not uncommon, which leaves long gaps if a pen test is your only check.
Where does reachability fit?
Reachability sits between the two. A scan can list a hundred vulnerable packages, and reachability analysis checks whether your code actually calls the vulnerable function. It is still automated and still based on known issues, so it narrows the scan list and does not replace human attack testing. Our reachability demo shows the idea.
Click through it at your own pace, or open it full screen.
How to choose between them
- Need to know what known issues exist now, cheaply and often: scan.
- Need to show a customer or auditor that controls hold against an attacker: penetration test.
- After a major release or infrastructure change: both, because PCI guidance treats significant changes as a trigger for each.
- Short on budget: fix scanner findings first so paid tester time goes to what automation misses.
- Unsure what an auditor accepts: ask for the exact wording of the requirement.
Frequently asked questions
Is vulnerability scanning the same as vulnerability assessment?
They overlap. Scanning is the automated technique, and an assessment can add manual review and prioritization. We cover the terms in vulnerability assessment vs penetration testing.
How often should each run?
PCI SSC guidance says scans at least quarterly and penetration tests at least annually, both after significant changes. Other frameworks differ, so check yours.
Which is cheaper?
Scanning usually is. Published cost guides give a few thousand dollars at most for automated scanning and $5,000 and up for a manual test. See how much a penetration test costs.
Does DAST count as a penetration test?
DAST is automated testing of a running application, so it sits closer to scanning. See DAST vs penetration testing.
Do scanners produce false positives?
Yes. NIST SP 800-115 notes high false positive rates for vulnerability scanning, which is why a person should verify results before acting on them.
Sources
- NIST SP 800-115, Technical Guide to Information Security Testing and Assessment
- PCI Security Standards Council, Penetration Testing Guidance v1.1, September 2017
- NCSC, Penetration testing
- NIST CSRC glossary, penetration testing
Last reviewed: 19 October 2026.
