Comparison
Penetration test or vulnerability scan?
The two terms are often confused, and some offers sell an automated scan as a “penetration test”. Here is the difference, and when to use each.
| Vulnerability scan | Penetration test | |
|---|---|---|
| Method | Automated | Manual, tool-assisted |
| Question | What isn’t patched? | How far can an attacker get? |
| False positives | Many, need triage | Verified findings |
| Chaining flaws | No | Yes |
| Frequency | Monthly or continuous | Yearly and after major change |
| Deliverable | Vulnerability list | Attack path, evidence, risk, fixes |
They complement each other
Scanning keeps hygiene current between tests; a pentest checks that defences really hold and reveals what tools can’t see: business logic, reused passwords, chains of small weaknesses.
How to spot a real penetration test
- A scoping call and written rules of engagement
- Evidence for every finding (screenshots, requests)
- Attack paths, not just a list
- A retest of fixes
Free tool
Open the calculator Take the cybersecurity self-assessment
Related services
Further reading
FAQ
Frequently asked questions
My insurer asks for a “pentest”: is a scan enough?
Read the exact wording. Many insurers and customers require a third-party test with a report; a simple scan may not qualify.
Planning penetration testing?
Describe your situation in a few lines; an engineer will call you back quickly. The site visit and quote are free.
Quote
Request a quote
Free, no obligation. A quick answer from an engineer, in English or French.
- Free site visit and quote
- An engineer, not a salesperson
- 15+ years’ experience, across Quebec
- Hardware stocked on altea.io
Updated 2026-11-05