Penetration testing and vulnerability assessment are often talked about as if they were one service. Procurement documents lump them into a single line, vendors sell them as a bundle, and budget conversations treat them as interchangeable. In practice the two are different jobs, with different methods, costs, cadence, and outputs, and teams that understand the difference get better security for less money.
The short version: a vulnerability assessment systematically finds, classifies, and prioritizes known weaknesses across your environment. A penetration test is a scoped, human-led engagement where testers actively try to exploit weaknesses to prove what an attacker could actually achieve. Both produce findings, but they answer different questions. An assessment tells you what is exposed. A penetration test tells you how far an attacker could get with what is exposed.
This guide compares penetration testing and vulnerability assessment in practice: how the two services differ, when to run each, and how they feed into each other on a realistic security programme.
A vulnerability assessment is a structured review of an environment or a defined set of assets, designed to identify weaknesses that are known to be dangerous and to hand you a ranked list you can work from. A typical assessment runs several stages:
An assessment can be scoped internally (running inside your network) or externally (from the internet, with no credentials or internal access). For a startup or SaaS team, the highest-value assessment is usually the external one: everything reachable from the public internet is exactly what an attacker sees, and a fast automated scan of your subdomains, services, email security, and web applications produces the biggest insight for the least effort.
Assessments are fast and repeatable. A good external assessment can complete in hours and be rescheduled weekly or monthly, which is what makes it the foundation of continuous monitoring. The trade-off is depth: an assessment is largely signature- and pattern-based. It is excellent at catching known issues across a wide surface, but it does not simulate the reasoning of a determined attacker.
A penetration test applies human skill inside a defined scope. A tester, almost always working under a written engagement agreement, performs reconnaissance, analyses the services they find, and then aggressively attacks the target with real-world techniques. The goal is not just to list weaknesses but to prove their consequences, often by chaining several small flaws into a large impact.
Because a person is in the loop, a penetration test can do things an automated scan cannot: test business logic such as order flows and loyalty programmes, evaluate authorisation boundaries between roles, combine an unpatched service with a misconfigured API to reach sensitive data, and assess whether a weakness is practically exploitable in your specific environment, including any compensating controls you run. This is where penetration testing tools and penetration testing software earn their keep, but the asset that matters most is the tester who decides what to do with them.
A penetration test runs as a discrete engagement. It has a scope (typically a defined set of hosts or a single web application), a window of days or weeks, and a human-written report that documents each finding, how it was exploited, its impact, and the recommended fix. The result is point-in-time: the report describes your posture on the days the test actually ran.
| Dimension | Vulnerability assessment | Penetration test |
|---|---|---|
| Goal | Find, classify, and prioritise known weaknesses | Prove exploitability and real-world impact |
| Method | Automated scanning, plus limited manual review | Human-led testing, with automated assistance |
| Coverage | Breadth: the whole external or internal surface | Depth: a narrow, pre-agreed target |
| Cadence | Weekly, monthly, or continuous | Annually, or on demand for major changes |
| Cost model | Predictable subscription, scales with asset count | Per engagement, typically £2,000 to £25,000+ |
| Evidence | Structured findings, ideally with captured proof | Narrative report with manual reproduction steps |
| Finding types | Known vulnerability patterns and misconfigurations | Chained attacks, business logic, novel paths |
Three of these differences drive most planning decisions, and they are worth unpacking.
An assessment can be automated to run every month or every week, so it tracks your posture as it changes. A penetration test is a snapshot: between two tests, your environment can change substantially, and much of that change (new subdomains, new deployments, new misconfigurations) will never be seen by the tester. The exposure that matters is usually the one that appears between engagements.
Assessments are subscriptions, so the cost is predictable and you can afford to run them constantly. Penetration tests are billed per engagement and the price climbs with scope and the seniority of the testers assigned. For most startups that means one or two tests a year, which is not enough coverage on its own.
On any given day, a vulnerability assessment will surface more individual issues because it stares at the entire surface at once and matches everything against a large database. A penetration test will report fewer issues, but each one is confirmed, contextualised, and often ranked by what an attacker could do with it. The right programme needs both signals.
The strongest sign in this space is a vulnerability assessment covering you all year, with a penetration test aimed at the riskiest areas. Here is the order that tends to work:
For most startups and SaaS teams, the practical rhythm is a penetration test once a year, plus an automated external assessment running weekly or monthly to cover the other twelve months. This closes the coverage gap that point-in-time testing has always left open between engagements.
Evidence is where the two services differ most visibly to a non-specialist reader. A penetration test report is narrative: each finding comes with the tester's steps, the observed behaviour, an impact assessment, and a professional sign-off. It reads like a story, which is why boards and customers respond to it.
A vulnerability assessment produces structured, repeatable findings. A quality scanner records the request, the response, and the payload that triggered the behaviour, so a reviewer can verify exploitability without reproducing it from scratch. The standard that matters is proof: at VeilScan, every Critical and High finding must come with reproducible exploit evidence before it is reported, and findings that cannot be verified are automatically downgraded. The result is a report your engineers can act on and your auditors can file without a second investigation.
The two evidence styles are complementary rather than competing, and it is the same finding viewed at two depths: the assessment proves it exists, the test proves what it is worth to an attacker.
Start with a vulnerability assessment. It is faster, cheaper, and it builds a baseline of what is exposed and what is fixable first. Use the ranked findings to scope a penetration test for the year ahead, so the human effort goes where the risk actually is.
Run a vulnerability assessment weekly, monthly, or after major deployments so you can track how your posture changes. Run a penetration test at least annually, and again whenever you launch a new high-risk surface such as a payment flow or an authentication system.
No. Some compliance frameworks, such as PCI DSS, explicitly require penetration testing, and no automated assessment substitutes for it. An assessment supports vulnerability management controls such as ISO 27001 A.12.6.1, but it does not replace a mandated human-led test.
No. Scanners are excellent at finding known patterns across a wide surface, but they cannot reason about business logic, chain unrelated weaknesses into a full attack, or test an approach that has never been written down. Use scanners for breadth and continuous coverage, and testers for depth and validation.
A vulnerability assessment is usually a subscription that scales predictably as you add assets. A penetration test is billed per engagement and typically ranges from £2,000 to £25,000+ depending on scope and test team seniority. That is why the assessment-first approach works: continuous, affordable coverage all year, with a deep test only where it is required.
No. A penetration test is point-in-time: it describes your posture on the days the test ran. The window between tests is where new deployments, misconfigurations, and forgotten assets appear, and that is exactly when attackers work. Continuous assessment closes that window.
Penetration testing and vulnerability assessment are not competitors for the same budget. They are two layers of the same programme. The assessment gives you continuous, broad coverage with a ranked list you can act on today, and the test gives you deep, validated risk you can present to a board, a customer, or an auditor. Teams that run both, in the right order, close the gaps that either service leaves open on its own.