Vulnerability scanning vs penetration testing: what is the difference?

A vulnerability scan is automated software that checks your systems regularly for known weaknesses, such as missing updates or risky settings. A penetration test is a person, or a small team, deliberately trying to break in, to show which weaknesses can actually be exploited and how far an attacker could get. Most small businesses should start with regular scanning and prompt patching, then add a penetration test at least once a year, or when a customer, insurer or tender asks for one.

How many businesses test?

In the government's Cyber Security Breaches Survey 2025/26, only 18% of businesses had carried out a vulnerability audit in the previous 12 months, and 13% had commissioned a penetration test. Attackers, meanwhile, scan the whole internet for known weaknesses every day.

So most businesses don't know what an attacker would find when they look. Either kind of testing puts you ahead of the majority.

At a glance

What a vulnerability scan does

A scanner compares what it can see of your systems against a database of known vulnerabilities. An external scan looks at what's exposed to the internet: your firewall, VPN or remote access, website and email. An internal scan looks at computers and servers inside your network.

Its strength is frequency. New vulnerabilities are announced every day, and attackers use automated tools to find systems that haven't been updated. Regular scanning means you hear about a problem in days, not at next year's test.

Its limit is that it reports weaknesses in theory. It can't tell you whether a weakness actually leads anywhere, and it can flag issues that turn out not to matter. That's why a good service has an analyst who ranks findings by how likely they are to be exploited, and explains how to fix them.

What a penetration test does

A penetration tester tries to break in the way a real attacker would, within limits agreed with you in advance. Common types for a small business are:

• External testing of your internet-facing systems.
• Internal testing: what an attacker, or an insider, could do once inside your network.
• Web application testing of websites, portals and online forms.
• Wi-Fi testing, including whether your guest network is properly separated.

The NCSC's penetration testing guidance makes an important point: a penetration test should be used to check that your own vulnerability management is working, not as your main way of finding vulnerabilities. It notes that "it's not uncommon for a year or more to elapse between penetration tests", so if testing is your only check, weaknesses can go unnoticed for a long time. It also recommends sharing your latest vulnerability assessment with the testers when you agree the scope.

Which should a small business start with?

• Start with scanning and patching. Know what you have facing the internet, scan it regularly and fix what's found promptly. This closes the doors attackers try first.
• Add a penetration test when:
  • a customer, insurer or tender asks for one;
  • you've made a significant change, such as a new system, a new office or a new website;
  • you hold sensitive data, such as client files or payment details, and want to know your defences hold up in practice;
  • it's been a year since the last one.
• Keep both going. Scanning between annual tests catches the weaknesses that appear in the other eleven months.

Choosing a penetration tester

• Check their qualifications. The NCSC says third-party penetration tests should be performed by qualified and experienced staff only. If a tender or contract names an accreditation, such as CREST or the NCSC's CHECK scheme for government work, confirm the testers hold it before you commit.
• Agree the scope in writing. What will be tested, when, what's off limits, and written authorisation to test.
• Ask to see a sample report. It should rank each finding by risk and explain how to fix it in terms your IT provider can act on, with a summary directors can understand.
• Ask about a retest. Once you've made the fixes, a retest confirms the holes are closed.

Our guide to what a penetration test costs covers typical prices and the questions to ask on a quote.

Where we can help

Our vulnerability management service scans your internet-facing systems, ranks what to fix first and warns you about newly discovered critical vulnerabilities. For testing, our own experts carry out penetration testing, and when a tender names an accreditation we can arrange testing through Sophos Advisory Services instead, confirming the testers' credentials meet it before you commit.

If you're not sure which you need, tell us what you've been asked for and we'll explain the options.

< Back to Guides