This article provides the differences between vulnerability scanning and penetration testing. While doing so, this article also explains some important concepts along the way.

Confusing between these activities is understandable given that both offer to identify security weaknesses in the IT system.

They differ regarding the depth of the testing activity, the time it requires, information input, accuracy, costs, scope, size and type of reporting, automation possibilities, compliance requirements, etc.

Furthermore, based on the environmental complexities, compliance requirements, size, and type of organization one will need to choose from either of them or a combination of them. This article will also explain WHEN to choose WHAT (type of) testing, (HOW & WHERE) the ways to implement, and the frequency of theirs.

To understand these processes in detail, let’s start with understanding some basics.

• What is vulnerability?

In the IT space, a vulnerability can be defined as a weakness in the (IT) systems such as servers, network devices, end-user devices, or any other device that is running, storing, or processing the information that can be exploited to compromise confidentiality, availability, the integrity of the information, product or the value it provides.

• What is Vulnerability scanning?

Vulnerability scanning is a process of identifying vulnerabilities. Often an automated process that scans devices, applications, or systems to identify vulnerabilities.

Vulnerability scanners use a vulnerability database. Such scanners test a system against this database and usually provide a high level of recommendations to fix the issue. Nowadays many scanner tools also provide helpful information to better prioritize the vulnerabilities.

A vulnerability scan is performed either using an agent which sits on the device itself or via the network often referred to as a network scan.  An agent-based scan is more accurate than a network-based scan. A vulnerability scan can either be authenticated or unauthenticated.  An authenticated scan is a special vulnerability scan where a scanner (both agent-based and network-based) is able to authenticate to the device in order to obtain more accurate and often in-depth information about the device and its vulnerabilities on such a device.  An authenticated scan is NOT always possible due to device compatibility issues.

• What is Vulnerability management?

Vulnerability management is a continuous process of identifying, evaluating, and fixing these vulnerabilities in an organization. The vulnerability management process can often be divided into 4 phases.

Scoping & Planning, vulnerability scanning & reporting, risk assessment & remediation, and rescanning.

Once a vulnerability scan is performed and results are available, the cyber security team along with system owners should prioritize the vulnerabilities based on threats to the company and the severity of the vulnerability.

The action plan is identified which can consists of acceptance, mitigation, or fixing of the vulnerability. Once a vulnerability is fixed, it should be verified whether such a vulnerability really has been fixed. This can be done in an automated way or sometimes needs to be done manually.

Vulnerability scanning is often performed at regular intervals. Based on the size of the environment, and the criticality of the devices, the scanning intervals can differ

• Penetration testing?

Penetration testing also referred to as pen testing or ethical hacking is an authorized simulated and in-depth test activity usually on a pre-agreed scope to identify weaknesses in the target scope.

This is a process that can involve an automated vulnerability identification phase which is followed by a manual test and verification. Depending upon the agreement with the owner, the identified weaknesses (vulnerabilities) are exploited to test the effectiveness of the control mechanisms in place. Such tests are often performed to evaluate security in depth. i.e. How strong a system or a device is against a potential attack possibility.

There exists different type of penetration testing types such as a white box, grey box, or black box. Often penetration tests are expected to be a black box where attackers are only given target information to be tested. This is a real-world scenario. However, approaches such as a grey box or white box tests are more beneficial where the penetration tester is provided with some or full information about the system(s) (such as its working, technology stack used, and its users) in scope. With this approach, organizations can save time and resources to evaluate the security of the system efficiently and is cost effective as compared with a black box test. We should always assume that a motivated attacker will always find ways to gather information about the scope and usually have virtually unlimited resources to perform reconnaissance.

• Should I perform Vulnerability scanning or Penetration testing?

Often people wonder whether they should opt for vulnerability scanning or penetration testing. The rest of the article discusses the differences and myths around these processes.

In my experience penetration tests and vulnerability scanning complement each other. Vulnerability scanning should not be a one-off process but a continuous process followed by a remediation activity. Please note that identifying vulnerabilities is not enough but fixing them is equally important. If you are responsible for an organization’s IT assets, irrespective of its size and technology one should really invest in the vulnerability management process. Please refer to Cyber Resolve’s service to establish Vulnerability Management Process. Where we help clients identify their assets and help with creating visibility and establishing an efficient vulnerability management process.

Due to the nature of the vulnerability management process, it identifies vulnerabilities, missing patches, security misconfigurations, and outdated applications. Furthermore, such a process will identify security flaws that have been recently discovered or a security misconfiguration, or unnecessary/ inadvertent open ports on devices. A continuous check will help organizations identify and fix the issues before attackers could take advantage of them. Whereas, a penetration test is an excellent way to identify security weakness and verify its susceptibility to a possible attack at any given point in time.

They both aim at finding the security weaknesses in the system. Often these tests are required by organizational policies, security frameworks, and security standards such as NIST, ISO 27001, PCI DSS, etc.

If you have read this article until here, I am sure you understand that they (vulnerability scanning and penetration test) cannot replace each other.

A penetration test is often performed when stakes are high. Often I strongly advise performing a penetration test at regular intervals and when something has significantly changed (such as system functionality, user base, technology stack). Often where a vulnerability scan stops, a penetration test starts. Regular intervals should be defined as per the organization’s policy or compliance requirements. If you are in need of a penetration test, please contact us at Sukalp.Bhople@Cyber-Resolve.com

A  note on automated penetration test: I understand that with technologies like AI and machine learning one can try to automate penetration testing activities but cannot replace a traditional (often manual) penetration test. Therefore, I would like to urge my readers to not confuse penetration tests with automated penetration tests and vulnerability scanning and to note that they are not the same.

Based on what we have discussed so far, the following table attempts to summarize the differences and commonalities between a penetration test and vulnerability scanning:

Factors	Vulnerability Scanning	Penetration Testing
Depth & Focus (scope)	Not in Depth and often is performed on a large scope.	In-Depth and often on identified targets.
Speed	Faster than penetration tests.	Often takes days.
Information input	Depending upon the type of scanning (authenticated / unauthenticated), more information and configuration might be required. But a simple scanning can be performed based on known IP addresses.	In its simplest form (black box), an IP address is enough. However, often system’s knowledge is shared. Credentials are provided based on the user types of the system.
Reporting	Simple reporting indicating what vulnerabilities are present.	Reporting is exhaustive providing details such as what issues are present and how attackers can take advantage of such issues. Often useful recommendations to fix these issues are also provided.
Automation	Often fully automated once configured.	Mainly a manual activity.
Cost	Cheaper. Often scanning licenses are available from vendors per IP or device.	Costlier than a simple vulnerability scan. As it involves manual activity and in-depth testing.
Quality	Result often contains false positives.	Comparatively, quality is better and provides a clear picture and prioritization of what needs to be fixed.
Frequency	Often performed at short regular intervals.	Often performed on selective scope and intervals are often not regular. If there is a compliance requirement, then penetration tests are performed at regular intervals and are performed on only selective scope. Often internet-facing devices/ applications and crown jewels.