They answer different questions, so a hospital review often wants both. A dependency scan finds known vulnerabilities in third party components across your whole inventory. A penetration test probes the running application for flaws, including logic and configuration problems scanners miss. Neither replaces the other.
What each one tells a reviewer
| Question | Dependency scan | Penetration test |
|---|---|---|
| Are known flaws present in third party code? | Yes, broad coverage | Only if the tester happens to exploit one |
| Can an attacker chain issues in my app? | No | Yes |
| Does it find broken authorization or business logic bugs? | No | Often |
| How often can it run? | Every build, daily | Typically once or twice a year |
| What does the output look like? | Findings tied to component versions | A narrative report with severity and fix advice |
| Does it show a point in time? | Yes, rescans refresh it | Yes, at the test date |
Why a reviewer asks for the test
A scan reports what is known. A test shows what a skilled person can do against your actual deployment, including how services are configured and how access control behaves. For software that handles patient data, reviewers like to see that someone has tried to break the authorization model.
Why a reviewer asks for the scan
A test samples your system. A scan covers every component you ship, and can run after every change. The Security Rule asks for a periodic evaluation and a response to operational changes (45 CFR 164.308(a)(8)). A schedule of scans supports that between annual tests.
How to present both
- Say how often each runs and who runs it.
- For the test, give the date, scope, and the share of critical and high findings closed, as a summary rather than the full report. Share the full report only under NDA and when the contract calls for it.
- For the scan, give the last run date, scope and how criticals were handled.
- Link the two. If the test found a vulnerable library, say how the scan process changed afterward.
Common mistakes
- Offering a scan as if it were a penetration test. Reviewers notice and trust drops.
- Offering a test from two years ago as current assurance.
- Handing over a raw tool export with no context.
- Describing test coverage as broader than the scope letter says.
Try it yourself
Click through it at your own pace, or open it full screen. It shows automated testing of a running app, which sits between a dependency scan and a manual test. Note what it finds and what it cannot.
Safeguard provides dependency scanning with reachability analysis and zero-day discovery for the inventory side. A manual penetration test is a separate engagement with a qualified tester.
Quick check
Can an automated scan count as a penetration test?
Describe it as what it is. Automated scanning is useful but is not the same as a skilled manual test, and reviewers distinguish them.
How often should a healthcare vendor test?
Many teams test at least annually and after major changes. Match your own policy and customer contracts.
Sources
Last reviewed: 19 October 2026.
