Vulnerability Assessment or Penetration Test? How to Tell Which Your Business Needs
October 26, 2026
A vulnerability assessment finds and validates weaknesses across your whole environment without exploiting any of them. A penetration test goes further. A tester actively exploits weaknesses and chains them together to show how far a real attacker could get. If your business has never had a security evaluation, start with a vulnerability assessment or a security posture review. If you have already cleaned up the basics, or someone needs proof of how your defenses hold up under attack, a penetration test is the next step.
The two terms get used interchangeably, including by insurers and customers who send a questionnaire asking for "a pentest." They are different services with different goals, and buying the wrong one wastes money in either direction. Here is how to tell them apart.
What a vulnerability assessment is
A vulnerability assessment is about breadth. The goal is to look at every system in scope and produce an accurate, prioritized list of what is wrong with each one.
Most of the work is credentialed scanning. The scanner logs in to each system with an account you create for the assessment, so it can see missing updates and insecure settings inside the machine rather than only what is visible from the network. Scanners produce a lot of noise, so the results are then reviewed and validated by hand. Each issue is confirmed with the lightest safe check, and nothing is exploited. Our assessments follow NIST SP 800-115, the federal guide to security testing, and every finding is rated Critical, High, Medium, or Low using CVSS v4.0.
What you get is a complete picture of your security hygiene. It shows which systems are behind on patches, which services are exposed that shouldn't be, and which settings need tightening, ranked so your IT team knows what to fix first.
What a penetration test is
A penetration test is about depth. Instead of cataloging every weakness, a tester works like an attacker would. They pick the most promising way in, use it, and keep going to see what they can reach from there.
The value is in how weaknesses combine. Picture a weak password on a little-used account, a file share that gives that account more access than it needs, and an administrator password saved in a script on that share. A scanner might rate each of those Medium on its own. Together they can hand an attacker control of the entire network. A penetration test finds chains like that and documents each step with evidence.
Network tests follow the Penetration Testing Execution Standard (PTES). Web application tests also follow the OWASP Web Security Testing Guide. Tests can cover your internet-facing systems, your internal network, and any web applications or customer portals.
One way to think about the difference is a physical exam versus a cardiac stress test. The physical checks everything and tells you what is out of range. The stress test pushes one system hard to see how it holds up under real load. Both are useful, and neither replaces the other.
What each one misses
Neither service does everything, and it helps to know the limits before you buy.
A vulnerability assessment tells you what is wrong, but not what an attacker could do with it. It won't show you that three moderate issues add up to a serious one, and it won't find flaws in how a web application handles logins or permissions, because those take a human trying things by hand.
A penetration test tells you how far an attacker gets, but it isn't an inventory. Testers follow the paths that lead somewhere, so a test can end with your network compromised and still not list every missing patch on every workstation. That is why a penetration test is not a substitute for regular vulnerability assessments.
How each one is done
Both start with scoping, where you agree on what is in scope, what is excluded, and when testing happens. You get a quote before any work begins.
For a typical small business, a vulnerability assessment takes two to three business days of active scanning, and the report arrives within about a week. External assessments run from the internet, and internal assessments can run remotely over a VPN connection, so nobody needs to be on site.
A penetration test takes longer. Scoping usually takes a few days of back-and-forth, mostly on your schedule, and the written rules of engagement cover excluded systems, testing windows, and who to call if something unexpected comes up. Hands-on testing typically takes one to two weeks depending on scope. External and web application testing are done remotely.
Both end the same way, with an executive summary for leadership, a findings report for your IT team, a prioritized remediation roadmap, and a walkthrough of the results.
What each one costs
Our vulnerability assessments start at $2,500. Penetration tests typically run $5,000 to $15,000. In both cases the price depends on scope, such as how many systems and locations are included, whether the work is external, internal, or both, and for penetration tests, how many web applications are in play.
The gap reflects the work. A vulnerability assessment is mostly tool-driven with expert validation. A penetration test is days of hands-on effort by an experienced tester.
Which one insurers and customers ask for
Read the exact wording of the request. Cyber insurance applications and customer security questionnaires can ask two different questions. One asks whether you scan for vulnerabilities, and the other asks when your last penetration test was. A vulnerability assessment answers the first. Only a penetration test answers the second.
If a form says "penetration test" and you aren't sure a full test is warranted, ask the requester whether a vulnerability assessment would satisfy it before you assume either way. It is also worth asking what they want to see as proof. The executive summary in either report is written to be shared with an insurer or a customer.
Which to do first, and how they fit together
For most small and mid-sized businesses, the order looks like this.
- Start with a baseline. If you have never had any kind of security evaluation, a security posture review (from $3,000) or a vulnerability assessment shows where you stand.
- Fix what it finds. Close the missing patches, exposed services, and weak configurations first.
- Then test. A penetration test on a cleaned-up environment spends the tester's time on the deeper paths that matter, not on documenting issues a cheaper assessment would have caught.
After that, the two settle into a rhythm. Many organizations run vulnerability assessments quarterly, and at minimum once a year and after significant changes such as a new office or a major upgrade. Common guidance for penetration tests is at least once a year, and again after major changes like a system migration or a new customer-facing application.
Side by side
| Vulnerability assessment | Penetration test | |
|---|---|---|
| Question it answers | What is wrong across our environment? | How far could an attacker actually get? |
| Approach | Breadth-first credentialed scanning with manual validation | Hands-on exploitation, chaining weaknesses together |
| Exploits weaknesses | No. Each issue is confirmed with the lightest safe check | Yes, within written rules of engagement |
| Standard | NIST SP 800-115 | PTES, plus the OWASP Web Security Testing Guide for web apps |
| Typical timeline | Two to three days of scanning, report within about a week | One to two weeks of testing after scoping |
| Price | Starting at $2,500 | $5,000 to $15,000 |
| Best for | Regular hygiene and a first look at where you stand | Proving real-world defenses and meeting "penetration test" requirements |
Not sure which you need?
Tell us what prompted the question, whether it is an insurance renewal, a customer questionnaire, or simply not knowing where you stand, and we will tell you which service fits. Sometimes the honest answer is the less expensive one. Contact Sanctus Cybersecurity to start the conversation.
Sanctus Cybersecurity provides penetration testing, vulnerability assessments, and security posture reviews to Iowa small and medium businesses. We are based in Iowa and serve businesses across the state and nationwide.