Pentest vs Vuln Scan: What's the Difference?

What a vulnerability scan actually does

A vulnerability scan is automated: point a scanner at your network or app and it comes back with a list of known weaknesses, ranked by generic CVSS score with no verification that any of it is actually exploitable in your environment. Scanners check against a database of known vulnerabilities and unpatched software. They don't chain findings, they don't understand context, and they often miss entire pieces of your attack surface because they lack checks for every system or application in your environment. It's cheap, it's fast, and it has a real place in your security posture: catching missing patches, exposed services, and configuration drift on a recurring basis. But it's not a substitute for exploitation.

What a penetration test actually does

A penetration test is a person working to get into your environment, exploiting real weaknesses to see what they expose. Instead of stopping at "this CVE is present," a tester exploits it and maps the path forward. Because of that, pentests routinely find vulnerabilities and misconfigurations that scanners never flag: weak service account passwords, misconfigured trust relationships, or chains of 'medium' findings that expose your most critical assets or hand over domain admin once linked together.

Why pentest severity ratings are more accurate

That chaining is also what makes the severity ratings in a pentest report more accurate. A scanner rates everything on generic CVSS scoring before it knows how, or if, something can actually be used. A tester rates it on what actually happened during the engagement: did this misconfiguration lead to initial access? Did this finding, combined with two others, lead to full domain compromise? A "medium" that turns out to be the first link in an attack path to domain admin gets rated accordingly. Pentests are built on attack paths, chaining multiple vulnerabilities together the way a real attacker would.

Red Raine Labs runs both

Red Raine Labs runs both out of West Michigan. You work directly with the person doing the testing, and the pentests are real exploitation, not a scanner output with a logo pasted on it. Every pentest also includes a vulnerability scan as part of the engagement. We don't lean on it for findings, but it adds extra visibility and coverage, especially for organizations that aren't already running scans on a regular basis.

Which one do you need?

• If you want a baseline list of known issues to start working through, that's a Vulnerability Assessment.
• If you want to know what an attacker can actually do and how far one compromised account or misconfiguration can take them, that's a Penetration Test.

Plenty of clients start with the assessment and move into a pentest once the obvious issues are cleaned up.