A vulnerability scan checks software and systems against a list of known weaknesses and reports matches. A penetration test has a person try to chain weaknesses into real access. Most labs need regular scans first. Either one needs written approval from whoever owns the systems and the network.
Definitions
Vulnerability scan. Automated. It inventories versions and configuration, then compares them with public vulnerability data. It is cheap, repeatable and produces a list.
Penetration test. Manual, scoped and time boxed. A tester tries to get in, move around and reach specific goals, then explains how.
NIST SP 800-115, published in September 2008, is a technical guide to information security testing and assessment. Its keywords include penetration testing, vulnerability scanning and security assessment. It was written long ago, so use it for the concepts, and check the CSRC page for its current status.
What each answers
| Question | Scan | Penetration test |
|---|---|---|
| Which known flaws do we have? | Yes | Partly |
| Which flaws can actually be chained? | No | Yes |
| How often can we run it? | Weekly or on every change | Rarely, often yearly |
| Who runs it? | You or a tool | A skilled person |
| Cost of a mistake | Low | Higher, it can disrupt services |
Which to start with
Start with scans. A pen test on a lab that has never patched anything mostly finds the same list a scan would have, at higher cost.
Consider a penetration test when you have a service that holds sensitive data, such as a participant database or a web portal with a login, and you have already fixed what scans find.
Approval comes first
On a campus, the network belongs to the institution. A scan that a student launches against a range, or against a neighbor's server, can set off alarms or disrupt fragile equipment such as lab instruments.
Before any scan or test:
- Confirm who owns each target system.
- Get written permission from that owner.
- Tell the campus security or network team the dates and source addresses.
- Limit the scope to what you listed.
- Decide what to do if something fails during the test.
This is a practical process point, not legal advice. Ask your institution's security office what its policy requires.
Scan your own code without a network scan
Much of a lab's risk sits in code dependencies, which you can check from a repository with no network traffic at all. A dependency scan reads lock files and manifests. It touches nothing live, so it is the easiest first step.
Safeguard's dependency scanning works this way, and a free scan needs only a project.
Reading the results sensibly
A scan report is a list of candidates. Some will be false positives, some will be accurate but irrelevant to how you use the software, and a few will matter. Plan time to read, not just to run.
A penetration test report is narrative. It describes paths an attacker could follow and usually gives each a rating. Use it to fix the paths, not only the individual weaknesses on them, and retest the fixes afterward.
Whichever you choose, agree up front what you will do with the findings and who has time to act on them. A report nobody acts on is the most common outcome.
Quick check
Can we run a scan on a shared cluster ourselves?
Only with approval from the operators. Shared systems have many users and some scans can slow or disturb services.
Does a clean scan replace a penetration test?
No. A scan finds known issues. A test tries to combine issues and finds problems a scan cannot name.
Sources
Last reviewed: 19 October 2026.
