Penetration Testing vs. Vulnerability Scanning: What a Growing Company Actually Needs

A 70-person company gets its cyber insurance renewal packet in October. Page six asks whether it performs "regular vulnerability scanning" and "annual penetration testing." A week later, a new client's security questionnaire asks the same two things in different words. The operations lead is not sure whether the company does either, or whether they are even separate things.

They are separate, and they answer different questions. A vulnerability scan asks, "What known weaknesses exist on our systems today?" A penetration test asks, "If someone tried to break in, how far could they get?" Most growing companies need both, at different intervals, and most do not need the most expensive version of either.

What a vulnerability scan does

A vulnerability scan is automated software that checks your systems against a database of known weaknesses. It looks at laptops, servers, firewalls, VPN devices, cloud settings and public-facing websites. It reports missing patches, outdated software, weak configurations and exposed services, usually with a severity rating for each.

Three things define a scan:

• It is broad. One scan can cover every device and internet-facing system in a few hours.
• It is automated. Software does the work, so it can run weekly or continuously.
• It stops at the finding. A scan tells you a door may be unlocked. It does not walk through the door to see what is behind it.

That last point matters. Scans produce false positives, and they cannot tell you whether three low-severity findings, chained together, give an attacker full access. A scan is a list. Somebody still has to decide what to fix first.

What a penetration test does

A penetration test is a scoped, authorized attack carried out by a person. The tester starts with a goal, such as "get into the finance share" or "reach customer records from the internet," and tries to achieve it the way a real attacker would. That includes chaining small weaknesses together, guessing or reusing passwords, abusing misconfigured permissions, and tricking systems into trusting the wrong thing.

NIST's technical guide to security testing, Special Publication 800-115, treats these as distinct techniques. Vulnerability scanning identifies hosts and flags known weaknesses. Penetration testing goes further by attempting to exploit those weaknesses to show what is actually possible.

Three things define a penetration test:

• It is deep. The tester follows one path as far as it goes instead of covering everything shallowly.
• It is manual. Judgment and creativity find what software misses, such as a business-logic flaw in a customer portal.
• It ends in a report. The deliverable is a written account of what was reached, how, and what to fix, usually with evidence.

The two side by side

	Vulnerability scan	Penetration test
Who does it	Software	A person using tools
Question answered	What known weaknesses exist?	How far could an attacker get?
Coverage	Broad	Narrow and deep
Typical frequency	Weekly to monthly	Yearly or after major change
Output	Ranked list of findings	Written report with proof

Neither replaces the other. A scan without a test can leave you with a long list and no sense of which items an attacker could actually use. A test without scanning gives you a snapshot that is out of date the next time someone installs software or changes a firewall rule.

Why this question keeps coming up

Three groups ask about both: cyber insurers, clients, and regulators.

Insurers. Cyber insurance applications ask about the controls you have in place, and your answers are the basis of the policy. Wording varies by carrier. Some ask only whether you scan for vulnerabilities and how often. Others ask whether you commission an outside penetration test and when the last one happened. Treat the exact wording in your own application as the requirement. Many vendors that sell testing say every insurer now demands a pen test, and that claim is stronger than the public record supports. Read your questionnaire before buying anything. Our guide on how to answer a cyber insurance questionnaire walks through how to map each question to controls you already run.

Clients. Enterprise customers and larger clients send security questionnaires that commonly ask for the date and summary of your last penetration test. A one-page executive summary from a recent test often closes that question in a single reply.

Frameworks. HIPAA requires a regular technical evaluation of security safeguards, and SOC 2 auditors look for evidence that you find and fix vulnerabilities. PCI DSS treats scanning and testing as separate requirements. Defense contractors working toward CMMC face similar expectations. None of these is the reason most growing companies buy a test, but each can turn "nice to have" into "required by next quarter." If a framework drives your situation, our compliance readiness work starts by working out which of these actually apply.

Why scanning matters more than most people expect

Attackers use known, unpatched weaknesses far more often than they use anything exotic. Verizon's 2025 Data Breach Investigations Report found that exploiting a vulnerability was the initial way in for about 20% of breaches, up roughly 34% from the year before, according to Infosecurity Magazine's coverage of the report. That put it just behind stolen credentials as the top entry point. The same report found that the median time to fix vulnerabilities in edge devices such as VPNs and firewalls was 32 days, as reported by Security Magazine. A weekly scan shortens the gap between a weakness appearing and someone noticing it.

The figures above come from the Verizon report as summarized by those outlets. Different publications frame the edge device numbers a little differently, so treat them as directional.

A practical schedule for a 25 to 200 person company

This is a sensible starting point for most growing companies, not a rule.

1. Scan internet-facing systems continuously or weekly. These are the ones attackers can reach without any foothold.
2. Scan internal devices and servers at least monthly. Quarterly is the floor, and only if patching is also tracked.
3. Test once a year, and after big changes. A new customer portal, a cloud migration, an acquisition or a major network redesign each justify a fresh test.
4. Scope the test to what matters. Pick the systems that hold client data, money movement or regulated records. A test of "everything" costs more and teaches you less than a test of your three most valuable systems.
5. Fix, then verify. Ask the tester to confirm critical findings are closed. A report nobody acts on helps no one, including the insurer.

Questions to ask before you hire a tester

• Is this a real manual test, or a scan with a new cover page?
• What is in scope, and what is excluded?
• Will I get a plain-language executive summary as well as the technical findings?
• Does the report include a retest of critical items?
• Is the tester independent of whoever manages my IT day to day?

That last question is worth asking. A test is more credible to insurers and clients when the people who built or run your environment are not the ones grading it.

Where this fits with managed security

Scanning is an ongoing job, which makes it a natural part of managed security. Elevaire Managed Security Plus includes vulnerability scanning alongside 24/7 detection and response, identity monitoring, backup and compliance reporting. Scan results feed the quarterly security review, so findings turn into a short prioritized fix list instead of a PDF nobody opens. Elevaire works alongside your existing IT provider here. Your IT team or MSP usually applies the patches, and Elevaire tracks what is open, what is overdue and what is risky. Our managed security service describes how the packages divide that work.

Penetration testing is different. It is a point-in-time project, quoted separately, and it should come from an independent party.

Example engagement: a 90-person property management company gets a renewal questionnaire asking about annual penetration testing and monthly scanning. Elevaire would confirm the company already has weekly external scans through its security package, scope a one-time test around the resident payment portal and the accounting system, and hand the executive summary to the broker with the renewal. The company's IT provider would receive the prioritized fix list and apply the patches.

Frequently Asked Questions

Is a vulnerability scan the same as a penetration test?

No. A scan is automated and finds known weaknesses across many systems. A penetration test is a manual, goal-driven attempt to break in, and it shows what an attacker could actually reach. Some vendors sell scans under the penetration test label, so ask what a person actually does.

Does cyber insurance require a penetration test?

It depends on the carrier and the policy. Some applications ask only about scanning, and others ask whether you test annually. The requirement is whatever your own application and renewal questionnaire say, so read it before you buy a test. Your broker can tell you what your carrier asks.

How much does a penetration test cost compared with a scan?

Scans cost far less because software does most of the work, and they usually come bundled into a managed security package at predictable monthly pricing with no hourly billing. A penetration test is a quoted project priced on scope: how many systems, how many applications, and how deep the tester goes. Get two or three scoped quotes and compare what each one includes.

How often should a growing company run each one?

Scan external systems weekly and internal systems at least monthly. Test once a year and after significant changes. If you handle regulated data, your framework may set a minimum frequency, so check it.

Can our current IT provider or MSP do this for us?

Often they can run scans and apply the fixes. Elevaire works alongside them so the work is shared instead of duplicated. For a penetration test, an independent party gives your insurer and clients more confidence than a test run by the team that manages your systems.

How do we get started?

Pull your latest insurance questionnaire and your last two client security questionnaires and highlight every testing question. That tells you what you are actually being asked for. Then confirm whether you have a current scan and a dated test report. If either is missing, that is your first project.