A vulnerability scan and a penetration test sound alike, but they answer different questions. This lesson explains what each one is, how a penetration test runs, and how the FTC Safeguards Rule schedules both. It is for security and IT teams who get asked for both.
- What it is
Two tests, two questions
A vulnerability scan is automated: it matches hosts against known weaknesses and reports what might be wrong, and some of those reports can be false positives. A penetration test has assessors mimic real attacks to see what can actually be exploited. Scanning is not the lesser test: NIST calls it extremely important, and notes that scanners rely on signatures, so they can also miss issues that a manual process finds.
- How it works
A pen test has four phases
In NIST's model: plan the rules and goals, discover hosts and weaknesses, attack to confirm those weaknesses and combine them to gain more access, and report. Reporting runs alongside the other phases, with a final written report at the end, and the attack phase can loop back to discovery. NIST notes there are many acceptable ways to group these steps.
Source: NIST SP 800-115, section 5.2.1
- Why it matters
One rule, two schedules
NIST suggests regularly scheduled scanning with periodic penetration testing in between. The FTC Safeguards Rule (16 CFR 314.4(d)(2)) puts numbers on it: absent effective continuous monitoring, vulnerability assessments at least every six months, and annual penetration testing scoped by the risk assessment. The rule also calls for assessments whenever there are material changes, and its term covers systemic scans or reviews, so it is broader than a scan.
Source: FTC Safeguards Rule, 16 CFR 314.4(d)(2); NIST SP 800-115, section 5.2.2
The takeaway: So, a scan finds possible weaknesses. A penetration test plans, discovers, attacks and reports, to see what an attacker could really do. And some rules ask for both, on different schedules.
More short lessonsADIR also offers a free external pen test for cloud teams: see the offer.
Transcript
People mix up vulnerability scans and penetration tests. They actually answer two different questions. A vulnerability scan is automated. It matches hosts against known weaknesses, so it reports what might be wrong, and some of it may not be real. A penetration test is different. Assessors mimic real attacks, to see what can actually be exploited. A penetration test runs in four phases. First, plan the rules and goals. Then discover hosts and weaknesses. Then attack, to confirm each weakness, and combine them to gain more access. Reporting runs alongside all of it. That's why some rules ask for both. NIST suggests regular scanning with periodic penetration tests in between. The FTC Safeguards Rule sets the pace: vulnerability assessments at least every six months, and a penetration test every year, absent effective continuous monitoring. So, a scan finds possible weaknesses. A penetration test plans, discovers, attacks and reports, to see what an attacker could really do. And some rules ask for both, on different schedules.
Narrated with an AI voice.
