Penetration test vs vulnerability scan: which one you need

What each one actually does

The three get sold interchangeably, which is how a $490 report ends up compared with an $8,000 one. NIST SP 800-115 separates scanning from testing, and the distinction is practical.

Vulnerability scan

What it does. A scanner sends requests, compares version banners with public vulnerability databases, and checks TLS, headers and exposed files. Fast, repeatable, no login.

How long it takes. Under an hour for a small WordPress or Shopify site; most of a day with triage.

What you receive. Tool output: finding, severity, host, port, CVE where one exists, generic remediation text. Usually CSV and PDF.

What it cannot prove. That a flagged plugin is exploitable in your configuration, that two low findings combine into something worse, or that one customer can reach another's data. No findings is not the same as no weaknesses.

Security audit (baseline review)

What it does. A person logs in read-only and reviews what a scanner cannot judge: admin accounts, abandoned plugins, update cadence, backups and restore tests, login protection and host configuration.

How long it takes. One to three business days; ours takes three because the review is manual and the report is written.

What you receive. A ranked report tying each finding to a setting, file or plugin, with impact, fix and owner. At Keelpost, PDF plus a plain-English summary.

What it cannot prove. That a chain of small misconfigurations can be exploited. Without exploitation, severity is judgement. A clean audit describes the checks done, not the absence of risk.

Penetration test

What it does. Authorised testers use scanners as a starting point, then work manually: authentication bypass, injection, business logic abuse, API access, privilege escalation. Scope, window and techniques are agreed in writing. The OWASP Web Security Testing Guide is a public method many testers follow.

How long it takes. Five to fifteen business days end to end. Testing is two to five days; scoping, reporting and retest fill the rest.

What you receive. Proof: request and response, screenshots, accounts used, business impact, remediation, and often a retest letter your auditor can file.

What it cannot prove. That the site is secure after fixes, that anything outside scope is safe, or that a later change will not reopen the hole. One window, one team.

How the three compare

Compare who does the work, how long it takes, what lands on your desk, how noisy the output is, and whether anyone may exploit anything. Prices are broad market ranges, not quotes.

Broad market ranges in USD, not quotes. Roles, APIs and retesting move the price more than tooling does.

What each one is actually for

A scan is for hygiene and regression. Run it monthly, after major updates and a host migration. It catches known CVEs, an expiring certificate and a missing header. A smoke alarm, not a diagnosis.

An audit is for the small site that needs a fix order this month. You have a budget, no customer asking for exploitation, and unknowns. The output says what to fix first and what can wait. What the security audit covers is a fixed scope.

A pentest is for a paying customer, a compliance requirement or a threat model that justifies it. Enterprise procurement, a custom checkout, tenant isolation, or an acquisition with unknown code. If none is true, an audit plus a scan buys the same reassurance for less; the managed security vs in-house comparison covers who runs it.

The five questions that decide which to buy

The first four point to an artefact; the fifth decides readiness.

1. Is there a deadline? If a contract or launch depends on a report by a date, work backwards. A pentest needs five to fifteen business days plus remediation; an audit fits in a week.
2. Is there a paying customer asking? Ask what they will accept: a report, a questionnaire or a letter. Get it in writing. If it is a questionnaire, answer the security questionnaire first and save the budget.
3. Does a compliance framework require an independent test? PCI DSS names quarterly scans and annual testing. SOC 2 and ISO 27001 do not name a cadence. Check the wording with your auditor.
4. What is the blast radius of a bug? Admin takeover, payment data, customer PII or cross-tenant access justify a pentest. A brochure site with a contact form does not. Match spend to breach cost.
5. Do you already have the basics fixed? Updates, multi-factor on admin, tested backups and least-privilege accounts come first. A tester will spend paid days reporting these; you can fix them this week.

The limits nobody puts in the proposal

A scan without triage is noise. Three hundred findings with no owner is a PDF, not a security programme. Triage means deduplicating, confirming what is real, ranking by business impact, assigning an owner and deciding fix or accept. Budget a day for it.

A pentest on an unpatched site is an $8,000 way to rediscover a free fix. If a plugin has a public CVE and an available update, the update is the fix. Testing it first proves you skipped maintenance, and the report will say so. Patch, then test.

A report nobody can action is worthless. Every finding needs seven things:

• the finding in one sentence
• the URL, file, plugin or setting
• evidence: a request, screenshot or config line
• business impact, not just a severity score
• the specific change, not "sanitise input"
• an owner and a priority order
• the retest that proves it is fixed

If a report has severity counts and no owner, send it back.

What compliance frameworks actually ask for

PCI DSS asks for quarterly external scans by an Approved Scanning Vendor (ASV), internal scans on the same cadence, and penetration testing at least annually and after significant change. Merchant level changes the scope; a QSA decides how it applies. The PCI Security Standards Council publishes the standard.

SOC 2 does not name a pentest or a scan cadence; auditors want evidence that vulnerability management operated across the period. ISO 27001 is risk-based: technical vulnerability management sits in Annex A, and the surveillance audit checks that you do what your risk assessment says. Neither mandates an annual pentest.

The common mistake is buying an annual pentest for a quarterly scan requirement, or a scan for a customer who asked for independent testing. Confirm the wording with your auditor.

Where Keelpost fits

We sell a non-intrusive website security audit from $490, delivered in three business days, and monthly care plans. We do not sell penetration tests. No exploitation, no attestation letter, no pretence that an audit is one. Audit and care plan pricing is published.

If you need a pentest, we will say so and help you write the brief. Ask any tester for:

• written scope and rules of engagement
• named testers and relevant experience
• professional indemnity insurance
• a sample report, not a summary
• a retest and an attestation your auditor accepts
• how they handle data they reach

If the need is a fix order rather than exploitation, the audit from $490 is the correct purchase. Send us the scope you were given and we will tell you which of the three it describes.