---
title: 'Vulnerability Scan vs Penetration Test'
url: 'https://triplepoint.org.uk/guides/vulnerability-scan-vs-penetration-test'
markdown: 'https://triplepoint.org.uk/guides/vulnerability-scan-vs-penetration-test.md'
date: '2026-10-28'
description: 'Vulnerability scan or penetration test? What each one finds, how often you need it, and which a UK small business should start with.'
---

# Vulnerability Scan vs Penetration Test

![](https://triplepoint.org.uk/user/pages/guides/vulnerability-scan-vs-penetration-test/vulnerability-scan-vs-penetration-test.jpg)

**A vulnerability scan is automated software that checks your systems regularly for known weaknesses, such as missing updates or risky settings. A penetration test is a person, or a small team, deliberately trying to break in, to show which weaknesses can actually be exploited and how far an attacker could get.** Most small businesses should start with regular scanning and prompt patching, then add a penetration test at least once a year, or when a customer, insurer or tender asks for one.

## How many businesses test?

In the government's [Cyber Security Breaches Survey 2025/26](https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026), **only 18% of businesses had carried out a vulnerability audit in the previous 12 months, and 13% had commissioned a penetration test**. Attackers, meanwhile, scan the whole internet for known weaknesses every day.

So most businesses don't know what an attacker would find when they look. Either kind of testing puts you ahead of the majority.

## At a glance

|  | Vulnerability scan | Penetration test |
|---|---|---|
| **Who does it** | Automated software, ideally with an analyst reviewing the results | A qualified tester, by hand, using an attacker's tools and techniques |
| **What it finds** | Known weaknesses: missing updates, outdated software, risky settings, systems you'd forgotten about | Which weaknesses can actually be exploited, how they chain together, and what an attacker could reach |
| **How often** | Continuously, or at least monthly | Typically once a year, and after significant changes |
| **How long** | Ongoing in the background | Usually days rather than weeks for a small business, plus the report |
| **What you get** | A ranked list of what to fix first | A report of what was tested, what was found, how serious it is and how to fix it |
| **Best for** | Staying on top of new weaknesses between tests | Proving your defences hold up, and evidence for customers, insurers and tenders |

## What a vulnerability scan does

A scanner compares what it can see of your systems against a database of known vulnerabilities. An **external scan** looks at what's exposed to the internet: your firewall, VPN or remote access, website and email. An **internal scan** looks at computers and servers inside your network.

Its strength is frequency. New vulnerabilities are announced every day, and attackers use automated tools to find systems that haven't been updated. Regular scanning means you hear about a problem in days, not at next year's test.

Its limit is that it reports weaknesses in theory. It can't tell you whether a weakness actually leads anywhere, and it can flag issues that turn out not to matter. That's why a good service has an analyst who ranks findings by how likely they are to be exploited, and explains how to fix them.

## What a penetration test does

A penetration tester tries to break in the way a real attacker would, within limits agreed with you in advance. Common types for a small business are:

- **External testing** of your internet-facing systems.
- **Internal testing:** what an attacker, or an insider, could do once inside your network.
- **Web application testing** of websites, portals and online forms.
- **Wi-Fi testing,** including whether your guest network is properly separated.

The NCSC's [penetration testing guidance](https://www.ncsc.gov.uk/guidance/penetration-testing) makes an important point: a penetration test should be used to check that your own vulnerability management is working, not as your main way of finding vulnerabilities. It notes that **"it's not uncommon for a year or more to elapse between penetration tests"**, so if testing is your only check, weaknesses can go unnoticed for a long time. It also recommends sharing your latest vulnerability assessment with the testers when you agree the scope.

## Which should a small business start with?

- **Start with scanning and patching.** Know what you have facing the internet, scan it regularly and fix what's found promptly. This closes the doors attackers try first.
- **Add a penetration test when:**
    - a customer, insurer or tender asks for one;
    - you've made a significant change, such as a new system, a new office or a new website;
    - you hold sensitive data, such as client files or payment details, and want to know your defences hold up in practice;
    - it's been a year since the last one.
- **Keep both going.** Scanning between annual tests catches the weaknesses that appear in the other eleven months.

## Choosing a penetration tester

- **Check their qualifications.** The NCSC says third-party penetration tests should be performed by qualified and experienced staff only. If a tender or contract names an accreditation, such as CREST or the NCSC's CHECK scheme for government work, confirm the testers hold it before you commit.
- **Agree the scope in writing.** What will be tested, when, what's off limits, and written authorisation to test.
- **Ask to see a sample report.** It should rank each finding by risk and explain how to fix it in terms your IT provider can act on, with a summary directors can understand.
- **Ask about a retest.** Once you've made the fixes, a retest confirms the holes are closed.

Our guide to [what a penetration test costs](https://triplepoint.org.uk/guides/penetration-test-cost-uk) covers typical prices and the questions to ask on a quote.

## Where we can help

Our [vulnerability management](https://triplepoint.org.uk/security/risk-and-assurance/vulnerability-management) service scans your internet-facing systems, ranks what to fix first and warns you about newly discovered critical vulnerabilities. For testing, our own experts carry out [penetration testing](https://triplepoint.org.uk/consultancy/penetration-testing), and when a tender names an accreditation we can arrange [testing through Sophos Advisory Services](https://triplepoint.org.uk/security/risk-and-assurance/security-testing) instead, confirming the testers' credentials meet it before you commit.

If you're not sure which you need, [tell us what you've been asked for](https://triplepoint.org.uk/contact?about=Security%20testing) and we'll explain the options.

## Questions

 Is a vulnerability scan enough for our customer, insurer or tender?+Sometimes. Read the wording: if it asks for a penetration test, or for testing by an accredited tester, a scan won't meet it. If it asks how you find and fix vulnerabilities, regular scanning and a record of what you fixed is often exactly what they want to see.

 Can a penetration test break our systems?+A well-run test is planned to avoid disruption: the scope, timing and any systems to avoid are agreed in writing before it starts. There's always a small risk with live systems, which is why a good tester will discuss anything risky with you first rather than just trying it.

 How often do we need each one?+Scanning should be continuous or at least monthly, because new vulnerabilities are announced every day. A common rule of thumb for penetration testing is at least once a year, and after any significant change such as a new system, an office move or a new website.

 What should a penetration test report include?+The NCSC says it should list the security issues found, the testers' assessment of the risk of each one, and a way to fix each one. A good report also has a plain-English summary for directors, and a retest once you've made the fixes.

 Where to go next- [Vulnerability management](https://triplepoint.org.uk/security/risk-and-assurance/vulnerability-management)
- [Penetration testing by our own experts](https://triplepoint.org.uk/consultancy/penetration-testing)
- [Penetration testing & security assessments through Sophos](https://triplepoint.org.uk/security/risk-and-assurance/security-testing)
- [Cyber insurance requirements: what UK insurers ask](https://triplepoint.org.uk/guides/cyber-insurance-requirements-uk)

[< Back to Guides](https://triplepoint.org.uk/guides)

## Not sure what you need?

Tell us a little about your business and we'll recommend the controls that will work best for you, with no obligation and no jargon.

[Talk to us](https://triplepoint.org.uk/contact)
or
[See every security area](https://triplepoint.org.uk/security)

Our experts spent 20 years at Sophos and include a certified ethical hacker.
[More about us](https://triplepoint.org.uk/about)

---

## Navigation

- Parent: [Cyber Security Guides for UK Small Businesses](https://triplepoint.org.uk/guides.md)
- Previous: [Secure Small Business Web Hosting: What to Look For](https://triplepoint.org.uk/guides/secure-web-hosting-small-business.md)