Vulnerability assessment vs. penetration testing
Two commonly confused services with different goals, different depth, and different places in a security programme.
A vulnerability assessment is broad: it systematically scans and reviews an environment to identify, classify and prioritise known weaknesses across many systems. It answers the question 'what could be wrong?'
A penetration test is deep: it targets a defined scope and attempts controlled exploitation to demonstrate what an attacker could actually achieve. It answers the question 'what happens if this is exploited?'
Most mature security programmes use both: regular vulnerability assessments to maintain broad visibility, and periodic penetration tests to validate that critical systems hold up under real attack conditions.
Want help applying this to your environment?
Tell us about your organisation and objectives. We'll help you find the right starting point.