BLOG

By David Chernitzky, Co-Founder and CEO, Armour Cybersecurity  |  Serving organizations across Canada, the US, and beyond  |  Last updated August 20, 2026

Quick answer: Vulnerability scanning is an automated process that identifies known weaknesses in systems and software by comparing them against a database of known vulnerabilities. Penetration testing is a manual, adversarial process in which certified security professionals attempt to exploit those weaknesses the way a real attacker would. Scanning tells you what might be vulnerable. Penetration testing tells you what is actually exploitable, what an attacker could do with it, and how far they could get through your environment. Both are useful; they answer different questions, and most compliance frameworks require penetration testing specifically because scanning alone is insufficient.

Key Takeaways

• Vulnerability scanners identify known vulnerabilities by matching system configurations and software versions against a database of published vulnerabilities. They cannot assess whether a vulnerability is actually exploitable in your specific environment, cannot chain multiple low-severity findings into a high-impact attack path, and cannot find vulnerabilities that require human creativity to discover, such as business logic flaws and authorization weaknesses.
• Penetration testing is conducted by human testers who approach your environment the way an attacker would: looking for weaknesses, chaining them together, exploiting them to demonstrate real impact, and documenting the path from initial access to objective. The human element is what finds the vulnerabilities that matter most, not the ones that are easiest to enumerate automatically.
• Most compliance frameworks including PCI DSS, SOC 2, ISO 27001, and HIPAA expect penetration testing, not just vulnerability scanning. PCI DSS is the most explicit, mandating it under Requirement 11.4. Auditors distinguish between the two and do not accept scan reports as substitutes for penetration test reports.
• Vulnerability scanning is appropriate as a continuous or frequent hygiene practice: monthly or quarterly scanning identifies new vulnerabilities as they are disclosed and tracks remediation progress. Penetration testing is appropriate at defined intervals, typically annually and after major changes, to validate that the security posture is sound in the ways a scanner cannot verify.
• The output of penetration testing includes chained attack path diagrams, proof-of-concept exploitation evidence, and business impact analysis that scanning cannot produce. This output is what gives executives and boards a realistic picture of organizational exposure, not just a list of CVE numbers.

What Vulnerability Scanning Actually Does

A vulnerability scanner is an automated tool that connects to systems, enumerates their software, configurations, and network services, and compares what it finds against a continuously updated database of known vulnerabilities. When it identifies a system running a version of software with a known vulnerability, it flags it with the vulnerability identifier, a severity score, and generic remediation guidance. Modern scanners can cover thousands of systems in hours and produce reports that list every identified vulnerability by severity, asset, and remediation category.

The value of scanning is breadth and speed. A scanner can cover the entire IP range of an organization’s network in a fraction of the time a human tester would need, and it will reliably identify every known vulnerability that matches its signature database. For organizations that want to ensure no system in their environment is running software with a published critical vulnerability, continuous or frequent scanning is the right tool.

The limitation of scanning is what it cannot do. It cannot determine whether a vulnerability that exists in theory is actually exploitable in the specific configuration of your environment. Many vulnerabilities exist in software versions running in organizations but are not exploitable because of compensating controls, network segmentation, authentication requirements, or specific configuration details that prevent exploitation. A scanner flags the vulnerability regardless; it cannot assess exploitability. It also cannot chain multiple findings together. An attacker who compromises an internet-facing server through a medium-severity vulnerability, then uses that access to find a misconfigured internal service, then escalates privileges through a separate weakness to reach a domain controller, has executed a chain of three findings that individually scored as medium severity but together produced a catastrophic outcome. A scanner produces three separate medium findings with no connection between them.

What Penetration Testing Actually Does

A penetration test is a structured, authorized attack against your environment conducted by certified security professionals following documented methodology. The tester approaches the engagement the way a skilled attacker would: they gather information about the target, identify potential weaknesses, attempt to exploit them, and if successful, use that access to explore further and demonstrate the actual impact of the breach. The process requires human judgment at every step: deciding which vulnerabilities to prioritize for exploitation, determining how to chain findings into attack paths, assessing whether a given exploitation technique will work against the specific configuration of the target, and evaluating the business significance of what has been reached.

The output is qualitatively different from a scan report. A penetration test report shows exactly how an attacker moved through your environment: the initial vulnerability exploited, the subsequent steps taken, the systems and data accessed, and the business impact of each stage. It includes proof-of-concept evidence that demonstrates the exploitation was real and reproducible. It includes attack path diagrams that make the chain of vulnerabilities visible to executives who need to understand the risk in business terms. And it includes remediation guidance written for the engineers who will close the gaps, with specific technical steps rather than generic references to vulnerability databases.

Penetration testing also finds vulnerabilities that automated scanning cannot detect at all. Business logic flaws, where an application can be manipulated to perform actions its designers did not intend, require a human tester who understands how the application is supposed to work and can probe for ways to make it behave differently. Authorization weaknesses, where a user can access resources or perform actions they should not be permitted to, require a tester who can reason about the access control model and test it adversarially. Social engineering vulnerabilities, where employees can be manipulated into disclosing credentials or taking unsafe actions, require human simulation that no automated tool can replicate. These are frequently the vulnerabilities that real attackers exploit, precisely because they are the ones that automated defenses and automated testing miss. The chained-together findings a penetration test surfaces are also exactly the standing exposures that belong on a security risk register, tracked and owned rather than buried in a scanner export.

When to Use Each

Vulnerability scanning: continuous hygiene

Vulnerability scanning is most valuable as a continuous or high-frequency practice that ensures newly disclosed vulnerabilities are identified quickly across the entire environment. An organization that scans monthly will identify a newly disclosed critical vulnerability affecting its systems within weeks of publication, giving the remediation team a defined window to patch before attackers begin mass exploitation of the vulnerability. Scanning is also useful for tracking remediation progress: running a scan before and after a patching cycle confirms which vulnerabilities have been addressed and which remain open. Most mature security programs run authenticated scans of internal systems monthly and unauthenticated scans of internet-facing systems continuously or weekly. Pairing scanning with strong endpoint detection and response closes the gap between a vulnerability being disclosed and being exploited, because the endpoint layer catches exploitation attempts that land before a patch does.

Penetration testing: periodic adversarial validation

Penetration testing is most valuable as a periodic, structured validation that the security posture holds up against realistic adversarial attack. Annual penetration testing is the baseline for most mid-market organizations, consistent with the requirements of PCI DSS, SOC 2, ISO 27001, and HIPAA. Additional tests should be conducted after major changes to the environment: a new application launch, a significant infrastructure migration, a cloud adoption project, a merger or acquisition that brings in new systems and networks, or a major code release on a customer-facing application. These change events are when new vulnerabilities are most likely to be introduced, because they involve modifications that have not yet been tested under adversarial conditions.

Armour Cybersecurity conducts manual, OSCP-certified penetration testing across network, application, cloud, and social engineering attack surfaces, with findings structured for direct use in compliance audits and remediation briefings delivered live to engineering teams.

Frequently Asked Questions

Can I use a vulnerability scan report to satisfy a penetration testing compliance requirement?

No. Frameworks that expect penetration testing require reports that demonstrate manual, adversarial testing by qualified personnel. PCI DSS is the most explicit: Requirement 11.4 mandates internal and external penetration testing at least every 12 months and after significant change, following a documented methodology, and a clean automated scan report does not satisfy it. SOC 2 and ISO 27001 are less prescriptive but still expect evidence of security testing appropriate to assessed risk, and auditors routinely ask for the testing methodology, tester credentials, and evidence of manual exploitation. A vulnerability scan report does not satisfy these expectations because it does not demonstrate manual testing, does not include exploitation evidence, and does not provide the attack path analysis and business impact assessment that penetration testing produces. Submitting a scan report in place of a penetration test report is a misrepresentation that can result in a compliance finding.

How often should we run vulnerability scans versus how often should we do a penetration test?

Vulnerability scans should run at minimum monthly for internal systems and weekly or continuously for internet-facing systems. Many organizations run authenticated internal scans monthly and maintain continuous external scan coverage through a managed vulnerability management service. Penetration testing should occur annually at minimum, with additional engagements triggered by major environment changes. For organizations in heavily regulated industries or with customer-facing applications under active development, quarterly penetration testing of specific high-risk targets such as the external perimeter or new application modules is a reasonable cadence. The annual full-scope test provides the compliance documentation; more frequent targeted tests address the change-driven vulnerability introduction between annual engagements.

What is an authenticated versus unauthenticated scan?

An authenticated scan provides the scanner with valid credentials for the systems being scanned, allowing it to log in and inspect the system from the inside: installed software versions, configuration settings, missing patches, and local security settings. Authenticated scanning produces significantly more comprehensive and accurate results than unauthenticated scanning and generates fewer false positives because the scanner can directly verify what is installed and configured. An unauthenticated scan tests only what is visible from the network without credentials, simulating the perspective of an external attacker who has not yet compromised any credentials. Both have value: authenticated scanning for comprehensive internal hygiene management and unauthenticated scanning for understanding the external attack surface. Most organizations run authenticated scans internally and unauthenticated scans of their internet-facing perimeter.

What is OSCP and why does it matter for penetration testing?

OSCP stands for Offensive Security Certified Professional, a certification issued by OffSec (formerly Offensive Security) that requires candidates to compromise a set of real systems in a controlled lab environment within a 24-hour hands-on exam. Unlike multiple-choice certifications that test theoretical knowledge, OSCP tests practical offensive capability: the ability to find, exploit, and document vulnerabilities under realistic conditions. OSCP is widely recognized in the penetration testing industry as a baseline credential for practitioners who can conduct real manual exploitation rather than running automated tools and repackaging their output. When selecting a penetration testing provider, OSCP credentials held by the testing team are a meaningful indicator that the testers have demonstrated practical offensive security capability, not just familiarity with security concepts.

What is black-box, grey-box, and white-box penetration testing?

These terms describe how much information the tester is provided about the target environment before testing begins. Black-box testing provides the tester with minimal information, typically just the target IP range or domain, simulating an external attacker who has no prior knowledge of the environment. Grey-box testing provides the tester with some information, such as user-level credentials, network diagrams, or application documentation, simulating an attacker who has obtained some information through reconnaissance or a limited initial compromise. White-box testing provides the tester with full information about the environment, including source code, architecture diagrams, and administrative credentials, enabling the most thorough assessment of the environment’s security but not simulating a specific real-world attacker scenario. Grey-box testing is the most common approach for enterprise penetration testing because it balances realism with efficiency: the tester spends time testing security controls rather than performing reconnaissance that an attacker would have done before the engagement.

The Bottom Line

Vulnerability scanning and penetration testing are complementary, not interchangeable. Scanning is automated, broad, and fast: it tells you which of your systems match a known-vulnerability signature, and it is the right tool for continuous hygiene and remediation tracking. Penetration testing is manual, adversarial, and deep: it tells you what is actually exploitable, chains individual findings into real attack paths, and surfaces the business logic flaws, authorization gaps, and social engineering weaknesses that no scanner can find. The frameworks reflect this, and PCI DSS makes it explicit under Requirement 11.4: a scan report does not satisfy a penetration testing requirement, and auditors know the difference. The right program runs frequent scanning for coverage and periodic penetration testing for validation, with additional tests after every major change. Armour Cybersecurity delivers manual, OSCP-certified penetration testing across network, application, cloud, and social engineering surfaces, with reports built for both the audit and the engineers who have to close the gaps.