In vulnerability assessment vs penetration testing, the difference is simple: a vulnerability assessment tells you what might be wrong. A penetration test tells you what an attacker can actually do with it. You usually need both, at different frequencies, and the combination is what people in India and the Middle East call VAPT.
This guide explains the difference in practical terms, walks through one example from both sides, and ends with a simple way to decide what to buy first.
Vulnerability assessment vs penetration testing: the short version
| Vulnerability assessment | Penetration test | |
|---|---|---|
| Question it answers | Which known weaknesses do we have? | Can someone break in, and how far can they get? |
| How it works | Mostly automated scanning, then triage | Manual testing by a person, supported by tools |
| Coverage | Wide: every host or page it can reach | Deep: the paths that matter most |
| Typical length | Hours to a couple of days | One to three weeks for most scopes |
| What you get | A long list of potential issues, ranked by score | A shorter list of confirmed issues, with proof and impact |
| False positives | Common, until someone checks them | Rare, because every finding is reproduced |
| Finds logic flaws | No | Yes |
| How often | Monthly or quarterly | Yearly, and after major changes |
What a vulnerability assessment actually does
A scanner such as Nessus, Qualys or OpenVAS connects to each system in scope and compares what it sees with a database of known issues: software versions with published CVEs, missing patches, weak TLS settings, default pages, open ports that should be closed.
It is fast and repeatable, which is why compliance frameworks ask for it on a schedule. PCI DSS, for example, requires internal and external vulnerability scans every quarter.
What a scanner cannot do:
- tell whether a “critical” finding is reachable in your environment,
- notice that one customer can read another customer’s invoices,
- chain three medium issues into one serious breach,
- understand your business rules, such as “a discount code works once”.
So a raw scan report needs a person to read it. A good assessment includes that triage step: removing false positives and putting the real issues in order.
What a penetration test actually does
A penetration tester starts where the scanner stops. They use the scan as a map, then try to exploit what looks promising, by hand, within the rules you agree beforehand.
The output is proof. Each finding shows the steps, the evidence and the impact: “with a normal customer account, we could read any other customer’s order history by changing one number in the request”. That is the kind of issue that turns into a data breach, and scanners almost never see it, because the server answers with a normal, successful response.
If you want the full picture of how a test runs, read our guide to what penetration testing is or our penetration testing process.
One example, seen both ways
Take a typical case: a small online lender with a customer portal, a mobile app and an API behind both. The details below are illustrative, but the pattern is one testers see constantly.
The vulnerability assessment scans the portal and its servers and reports 46 issues: an outdated nginx version, two weak TLS ciphers, missing security headers, a directory listing on a forgotten staging subdomain, and dozens of informational items. Most are low or medium. Nothing says “your customers’ loan documents are exposed”.
The penetration test logs in with two test customer accounts. Within the first day the tester notices that document downloads use a sequential ID. Changing the ID returns another customer’s bank statement. The forgotten staging subdomain from the scan turns out to hold a copy of the admin panel with a default password. Those two findings together are a reportable data breach waiting to happen.
The scan was useful: it pointed at the staging subdomain. But only the manual test showed what it meant.
So what is VAPT?
VAPT stands for vulnerability assessment and penetration testing. It is the combined service: scan everything, then test the important parts by hand. The term is common in India, where regulators such as RBI and SEBI and CERT-In’s audit guidelines use it. Read our guide to VAPT requirements in India for who needs it and how often.
Every Krylo Security engagement works this way. We scan for known issues, then test by hand, and only findings we have confirmed reach your report.
How to decide what you need
Answer these in order:
- Do you need it for compliance or a customer contract? Read the exact wording. PCI DSS requires both scans and penetration tests. SOC 2 and ISO 27001 auditors usually expect a penetration test. If the requirement says “penetration test”, a scan will not pass.
- Do you handle personal or financial data behind a login? Then you need a penetration test, because the serious risks are in access control and business logic, which scans cannot find.
- Do you change your systems often? Run automated vulnerability scans continuously or monthly, and a penetration test at least once a year and after major releases.
- Is your budget tight? Start with a scan you triage yourself, fix the obvious issues, then buy a focused penetration test of your most exposed application. A short, deep test of the right target beats a long, shallow one.
Common mistakes
- Calling a scan a penetration test. Some providers sell an automated scan with a branded PDF as a “pentest”. Ask how many days of manual testing are included and whether every finding is reproduced.
- Fixing scan findings by score alone. A CVSS 9.8 on a server nobody can reach may matter less than a medium issue on your login page. See our guide to CVSS scores.
- Testing once and stopping. Both are snapshots. Your systems keep changing after the report.
Frequently asked questions
Is a vulnerability assessment part of a penetration test?
Usually, yes. Most penetration tests start with automated scanning to map the target. The difference is that a penetration test goes on to exploit and confirm findings, and the scan alone does not.
Which is more expensive?
A penetration test, because it needs days of skilled manual work. A vulnerability assessment is cheaper and faster, which is why it is run more often. See our penetration testing cost guide for typical ranges.
Can we run vulnerability scans ourselves?
Yes. Many teams run their own scans monthly and bring in an outside firm for the penetration test. Just make sure someone reviews the results, because untriaged scan reports tend to be ignored.
How often should we do each?
Vulnerability scans monthly or quarterly, and continuously for internet-facing systems if you can. Penetration tests at least yearly and after significant changes. Our guide to how often to run a penetration test goes into the detail.
Get both in one engagement
Krylo Security combines scanning with hands-on testing of your web applications, APIs, mobile apps and networks. Book a free scoping call and we will tell you which one you need first.
For the methodology behind security testing, see NIST’s SP 800-115, Technical Guide to Information Security Testing and Assessment.