A vulnerability scan tells you which known weaknesses might be present. A penetration test tells you which ones an attacker could actually use and how far they’d get. This guide compares the two, walks one office network through both, and gives you a decision table.<\/p>\n\n\n\n
Related guides<\/strong><\/p>\n\n\n\n A vulnerability scanner is software that checks your systems against a database of known weaknesses: missing patches, outdated software versions, weak settings, expired certificates and services that shouldn’t be exposed.<\/p>\n\n\n\n NIST SP 800-115<\/a>, a widely used US government guide to security testing, sums up what scanning does well and badly. Scanners identify hosts, open ports and known vulnerabilities, and often suggest fixes. But they "rely on a repository of signatures", can have "a high false positive error rate (i.e., reporting vulnerabilities when none exist)", and the results need someone with networking and operating system expertise to interpret them.<\/p>\n\n\n\n Scans come in a few forms:<\/p>\n\n\n\n Speed matters more than it used to. ASD’s Annual Cyber Threat Report 2025-26<\/a> says it has previously observed most vulnerability exploitation within two weeks, some within 48 hours of a patch or advice being released, and expects AI-driven tools to shorten that further. Its advice is to accelerate patching, and it notes that "regularly scanning for missing patches" helps organisations close the gap between a new vulnerability and its fix.<\/p>\n\n\n\n A scan on its own is a list. Vulnerability management<\/strong> is the process around it: finding your assets, scanning, ranking findings by real risk, getting them fixed and confirming the fix.<\/p>\n\n\n\n A penetration test is a person (or small team) attacking your systems with your written permission, within an agreed scope and rules. NIST puts the key difference in one line: "While vulnerability scanners check only for the possible existence of a vulnerability, the attack phase of a penetration test exploits the vulnerability to confirm its existence."<\/p>\n\n\n\n Testers use scanners too, but as a starting point. The value is in what the tool can’t do: judging context, testing business logic, and chaining several minor issues into a serious one. Our guide to what happens in a penetration test<\/a> covers the full process.<\/p>\n\n\n\n\n\n
TL;DR<\/h3>\n\n\n\n
\n\n
In this post<\/h3>\n\n\n\n
\n\n
What is a vulnerability scan?<\/h2>\n\n\n\n
\n\n
\n\n\n\nWhat is a penetration test?<\/h2>\n\n\n\n
\n\n\n\nHow do they compare?<\/h2>\n\n\n\n