Penetration testing versus a vulnerability scan

People often ask whether a penetration test is the same as running a security scanner. It is not, and the difference is the whole point of the service.

• A vulnerability scan is automated. Software checks your site against a list of known issues and produces a report. It is fast and useful for catching obvious, well-known problems — but it pattern-matches, and it cannot reason.
• A penetration test is a real person probing your site the way an attacker would. That human judgement is what finds logic flaws, chained vulnerabilities and context-specific weaknesses a scanner walks straight past.

Automated scanning also throws up false alarms and misses anything that depends on understanding what your site is meant to do. Our test is manual ethical hacking precisely because it delivers far more accurate, real-world results than a scan alone. The two are complementary, but only a manual test finds the issues that truly matter.