Penetration test vs Vulnerability assessment

Why they differ

An assessment ranks weaknesses on paper; a pentest proves which ones can really be used by trying.

Controls & technical basics

An agreed, simulated attack in which skilled testers try to break in, to show how well systems really hold up.

Formal

An authorised test, limited in scope and time, in which people use the same methods as real attackers to find and actually use weaknesses, chaining them together to show what an attacker could reach.

In plain English

Like hiring a professional burglar to try to break into your shop, with your permission, and then write down exactly how they got in.

In practice

Testers hired by a Danish region find a forgotten test website, use a weak password there to get onto the network, and within two days show the IT security manager they can read the finance folder.

Why it matters

Lists of weaknesses do not show how they combine; seeing a real path from outside to valuable data convinces management and shows what to fix first.

Vulnerability assessment

Controls & technical basics

A review of systems to find their weaknesses and rank which ones matter most to fix first.

Formal

A structured review that gathers weaknesses - from scans, settings and interviews - and rates each by how likely it is to be used and how much harm it could do to the organisation's assets, giving a ranked list for action.

In plain English

Like a surveyor's report on a house - it lists every crack and leak, then tells you which ones will bring the roof down and which can wait.

In practice

A scan at a regional hospital finds 400 issues; the IT security team's assessment shows that only 12 sit on systems holding patient data that can be reached from the internet, and those go to the top of the list.

Why it matters

No team can fix everything at once; ranking weaknesses by real risk makes sure limited time goes where it prevents the most harm.

Shared connections

Vulnerability Vulnerability scanning