A vulnerability scan and a penetration test can look at some of the same systems, but they answer different business questions.
A scan asks: What known weaknesses might be present?
A penetration test asks: What could a malicious actor achieve by combining the weaknesses that are present?
Both can be useful. Confusing one for the other creates poor expectations, weak audit responses, and a report that does not answer the question leadership thought it bought.
Vulnerability scanning: broad, repeatable coverage
A vulnerability scanner compares observed services, software, and configurations against a set of known checks. It is useful for routine asset coverage, patch and configuration review, exposure tracking, and identifying systems that deserve human attention.
The output is a prioritized list of possible weaknesses. It may include duplicate results, false positives, issues that are already mitigated by another control, and technically valid findings that do not create a practical attack path in the assessed environment.
A high or critical scan result gets our attention, but the label is not the end of the investigation. Praeven checks the product and version when possible, examines what the vulnerability actually requires, and looks for public exploits or reports of attackers using it. A visible version can also mislead: a vendor may have backported a fix without changing the version string the scanner recognizes. If we cannot verify the version, we report the finding as scanner-indicated, not confirmed.
That does not make a scan less valuable. It makes the scan a discovery and maintenance tool. The National Institute of Standards and Technology (NIST) describes vulnerability scanning as a way to identify hosts, services, and known weaknesses; it is one input into a larger assessment process. NIST Special Publication 800-115
Where an External Exposure Review fits
Praeven's External Exposure Review examines public-facing systems and information an attacker could use. It combines technical checks, public-source research, analyst review, and remediation priorities. It shows what needs attention and what changed from month to month.
It is a good starting point for a small organization that needs to understand what is publicly reachable, whether known issues need attention, and who owns the response.
Explore External Exposure ReviewDiscuss the review
Penetration testing: controlled validation
A penetration test investigates whether a malicious actor can turn weaknesses into access or impact that matters to the business. Depending on the environment, that may involve gaining access, escalating privileges, or moving between systems.
A strong report documents what was tested, what worked, what did not, the evidence, and the changes that would make the path harder to use.
I have seen high and critical scanner findings fall away after manual checking. I have also seen a finding become more urgent when testing showed that it could actually be used. The difference is evidence. A version match suggests a weakness; a demonstrated path tells the business what a malicious actor could reach.
NIST identifies an attack phase as central to penetration testing. A scanner can surface a candidate weakness; a tester has to investigate whether it can be used to reach something that matters. NIST Special Publication 800-115
The practical difference
| Question | Vulnerability scan | Penetration test |
|---|---|---|
| Primary purpose | Identify known weaknesses at scale | Determine whether weaknesses create a realistic attack path |
| Typical cadence | Recurring | Periodic or change-driven |
| Coverage | Broad asset coverage | Focused systems and scenarios |
| Exploitation | Not required | Used to validate whether a weakness enables access or impact |
| Main output | Findings for triage and remediation | Evidence-backed attack narrative and remediation priorities |
| Best use | Ongoing hygiene and exposure review | High-value validation, assurance, or a specific business question |
The report title is not the evidence
This distinction matters most when a customer, acquirer, or auditor asks for proof. A passing scan is not a shortcut to a penetration test, and a penetration-test report is not proof that every asset has recurring scan coverage. The evidence has to answer the question that was asked.
PCI SSC makes the boundary clear: an Approved Scanning Vendor's external-scan report does not show that other PCI DSS requirements were reviewed or met. A passing scan is evidence of a scan, not proof that a malicious actor could not get in. PCI SSC FAQ 1234
NIST makes the broader point: technical assessment methods have different strengths and limitations, and no single technique provides a complete picture. A penetration test commonly uses discovery and vulnerability scanning as inputs, but adds a controlled question about what can actually be achieved. NIST SP 800-115
Ask for the answer, not the label
When someone asks, "Do you have a pen test?", find out what they need to decide. Are they asking whether public systems are checked regularly for known weaknesses? Or whether a malicious actor could combine weaknesses into access to a critical system or data? Those are different questions.
The answer should show what was found, what was actually validated, and what changed afterward. If the report only lists possible weaknesses, do not call it a penetration test. If a test proved one attack path, do not mistake that for continuous coverage of every public system.
Praeven's External Exposure Review keeps public exposure in view with recurring scans, OSINT reporting, and a threat brief. A penetration test answers a different question by validating what an attacker can achieve along a focused path.
When a penetration test is the right request
Ask for a penetration test when a critical application or major change needs a demonstrated attack path, or when a customer or board needs evidence of what a malicious actor could actually reach.
An External Exposure Review does not replace that work. Choose the assessment that answers the decision in front of you, then judge the result by its evidence.
A scan finds candidates. A penetration test follows the path. The distinction matters most when someone has to decide what to fix first.