A vulnerability scan finds known weaknesses with tools. An assessment is a broader review that may include scans. A penetration test attacks to prove what can be exploited. A red team tests detection and response. A bug bounty pays outside researchers. A disclosure policy tells them how to report. Definitions follow.
The glossary
| Term | Short definition | Typical output |
|---|---|---|
| Vulnerability scan | A technique used to identify hosts and host attributes and the vulnerabilities associated with them (NIST) | List of findings to validate |
| Vulnerability assessment | A review that identifies and ranks weaknesses, usually scans plus analysis | Ranked findings and fixes |
| Penetration test | Security testing that mimics real world attacks to find ways around security features, often looking for combinations of vulnerabilities (NIST) | Report with verified findings |
| Red team exercise | A broader adversarial exercise that tests whether people, process and detection catch an intrusion | Narrative of attack and response |
| Bug bounty | A standing offer to pay researchers for valid reports in a published scope | Individual reports |
| Vulnerability disclosure policy | A published statement of scope, how to report, and a promise not to pursue good faith researchers | Intake channel |
| Fuzzing | Feeding unexpected inputs to find crashes and bugs | Crashing inputs |
Overt and covert
NIST SP 800-115 separates overt testing, done with the knowledge and consent of IT staff, from covert testing, done without staff knowing but with the knowledge and permission of upper management. A red team exercise is usually the covert kind, and many pen tests are overt.
Which term do you actually need?
- We want to know what known weaknesses we have. Scan, then assess.
- We want proof of what can be exploited. Penetration test.
- We want to know if we would notice an attack. Red team or purple team exercise.
- We want outside researchers to be able to tell us things. Disclosure policy first, bounty later.
Words to be careful with
- "Audit" usually means a compliance review against a standard, not a technical test.
- "Pen test" is sometimes used for a scan. See how to tell if a pen test is just a scanner report.
- "Continuous pen testing" can mean frequent automated testing. Ask what is manual.
- "Compliance scan" may mean a configuration check against a benchmark.
Quick check
Is a vulnerability assessment the same as a penetration test?
No. An assessment identifies and ranks weaknesses. A penetration test tries to exploit them to confirm what an attacker could do.
What is the difference between a red team and a pen test?
A pen test aims to find and exploit weaknesses within a scope. A red team exercise tests whether your people and detection catch an intrusion.
Do I need a bug bounty?
Not to start. A disclosure policy gives researchers a way to report. Add a bounty when you can triage and fix reports quickly.
Safeguard works at the scanning end of this list, with SBOM and dependency scanning and reachability analysis. Try the free scan.
Sources
- NIST glossary: vulnerability scanning
- NIST glossary: penetration testing
- NIST SP 800-115 full text (PDF)
- CISA BOD 20-01, vulnerability disclosure policy
Last reviewed: 19 October 2026.
