Penetration Test, Security Audit or Vulnerability Scan: Which Do You Need?

“We need a pentest” is the phrase we hear most often, and half of the time the client actually needs something else: an audit, a scan, or both in a specific order. Three terms - vulnerability scan, security audit and penetration test - are sometimes used interchangeably, although they differ in depth, purpose, price and what question they answer. This article will help you choose the right tool for your situation.

Three different questions

The easiest way to distinguish these services is by the question they answer:

Vulnerability Scan - “Do you see any known, obvious vulnerabilities?”
Security Audit - “Are our security, configurations and processes consistent with good practices and requirements?”
Penetration Test - “How far will a real attacker go and which path to close first?”

These are not competing services, but different levels of looking at security. Let’s see each one individually.

Vulnerability scan: fast, automatic, superficial

A scan is an automated system check for known vulnerabilities and configuration errors. The tool compares detected software versions and settings with the signature database and returns a list of potential problems.

Advantages: fast (minutes to hours), cheap or free, can be repeated frequently - ideal for continuous hygiene monitoring.

Limitations: the scanner only sees what is in the database. It won’t understand your application’s business logic, won’t combine two small bugs into one dangerous chain, and generates false positives that someone has to manually verify. The scan answers the question “is there a known hole”, not “can we be hacked?”

A free example of a passive scan is our site security scanner: checks HTTPS, security headers, email configuration (SPF/DMARC/DKIM), certificate and file exposure in seconds. This is a great first step and part of a routine check - but, as we emphasize in the results, it is not a substitute for deeper analysis.

Security Audit: Compliance and Configuration Review

An audit is a systematic, largely manual review of an organization’s security against an adopted reference point - it may be a standard (ISO 27001), a regulation (NIS2, DORA, GDPR) or a set of good practices (CIS Benchmarks).

The audit looks broader than just one system: it covers architecture, configurations, access management, processes (backups, incident response, vulnerability management) and documentation. It answers the question of whether an organization is doing the right thing the right way - not necessarily by attempting a break-in, but by verifying that the mechanisms are in place and working.

An audit is irreplaceable when the goal is certification, meeting a regulatory requirement or organizing the security of the entire organization. However, it will not answer whether a specific application can actually be compromised - a test is needed for this.

Penetration test: controlled attack

Pentest is a human-led simulation of a real attack. The tester, within the agreed scope and on the basis of the contract, actively tries to break the security: bypass authorization, exploit a vulnerability, combine several small errors into a scenario leading to data or system takeover.

What a scanner won’t do is the essence of a pentest:

Business logic - is it possible to buy a product for PLN 1,000, view someone else’s order, bypass the transaction limit.
Chains of vulnerabilities - a single bug can be harmless; three combined will take over the administrator account.
Access control - whether a regular user can reach functions or data reserved for other roles.
Confirmation of real impact - instead of a “potential vulnerability” you get proof (PoC) that the attack works.

The result is a report with risk assessment, evidence and specific remediation steps - and in our case also a retest included, i.e. checking that the fixes actually closed the vulnerabilities. We describe how to prepare a company for such a test in a separate guide: How to prepare for a penetration test.

Black-box, grey-box and white-box testing

Pentests are also classified by how much information the tester receives about the target:

Black-box - the tester knows nothing about the system beyond what the outside attacker knows. Realistic, but time-consuming and some areas may remain untested.
Grey-box - the tester receives limited information and user accounts. The most common compromise: covers the application well in a reasonable amount of time.
White-box - full access to documentation and code. Deepest coverage, best for critical systems.

For most web applications, we recommend grey-box - it gives the best coverage to cost ratio.

Which service should I choose?

Some common situations:

“We want to quickly check the basic hygiene of the site.” Start with scan. If it does poorly, you immediately have a list of cheap fixes.
“We are implementing a new application / payment function / login.” Penetration test before production launch. The scanner will not check the business logic.
“We need to meet a regulatory requirement or prepare for ISO 27001.” Security audit; often regulations (e.g. DORA) also require testing, so both.
“There was an incident / we suspect a burglary.” This is not a task for a scan - what is needed is incident response and post-intrusion analysis.
“We want to maturely manage security permanently.” Combination: cyclical scan and vulnerability management on a daily basis, audit once in a while, pentest in case of significant changes.

Common error: scan “disguised” as a pentest

Beware of “penetration test” offers that are actually an exported scanner report with a logo attached. You will recognize them because the report is a long list of automatic findings with no confirmation of impact, no assessment of business logic and no attack chains. A true pentest contains evidence, manual verification, and conclusions that no tool can draw on its own. The difference is also visible in the fact that the report separates the management layer from the technical details for the team.

Summary

Scan, audit and pentest are three different levels of the same goal - understanding and reducing risk. The scan tells you whether there are obvious gaps; audit – are you doing the right things; pentest - whether you can be hacked and how. The most mature organizations use all three at appropriate times, not in place of each other.

If you are unsure which first step fits your situation, contact us - we will help you choose a scope that matches the real risk rather than a buzzword. See our complete security services.

Frequently asked questions (FAQ)

How often to perform a penetration test? The standard is once a year and after each significant change: a new application, large function, infrastructure migration or architecture change. Regulations in some sectors (finance, critical infrastructure) impose their own frequency. It is worth conducting periodic scans and vulnerability management between tests.

Can pentest damage our production? The risk exists, which is why the scope, time window and rules (e.g. disabling DoS tests) are established before launch, and tests on sensitive systems are often conducted in an environment close to production. A professional tester works carefully and agrees on the boundaries with you - this is part of the contract, not improvisation.

How long does a penetration test take and how much does it cost? It depends on the scope - number of applications, roles, integration and the selected variant (black/grey/white-box). A simple application test takes several days of work, a complex environment takes several weeks. Therefore, the quote always precedes the work and results from the agreed scope, without hidden costs.

Is a free online scanner enough for a small business? As the only protection - no, but as a regular element of hygiene - absolutely. The scanner will detect missing headers, weak HTTPS and email configuration errors, which are responsible for a large part of real incidents. However, for an application that processes customer or payment data, it is worth planning at least a one-time pentest.