Vulnerability scan vs penetration test: Security+ explained
A vulnerability scan is an automated check that reports known vulnerabilities and has a high false positive rate. A penetration test mimics real attacks and tries to exploit weaknesses, often by chaining several of them, to show what an attacker could actually reach.
Vulnerability scanning
NIST SP 800-115 says scanners compare a system's responses against signatures of known vulnerabilities and report the matches. They are fast and cheap, but they find only surface vulnerabilities on active systems and can report flaws that do not exist.
Local scanning, with a scanner installed on each host, finds more detail than network-based scanning because it usually has local access and a root or administrator account. A scan from outside the perimeter sees open ports but can miss outdated software on the host.
Findings need validation. SP 800-115 says manually examining the system typically gives more accurate results than comparing a second tool's output, because a second tool often repeats the same false positives.
Penetration testing
A penetration test launches real attacks on real systems to find ways around security features. Most tests look for combinations of vulnerabilities that give more access than any one flaw. If an exploit succeeds, the vulnerability is verified.
It is labor-intensive and can damage systems, so it needs careful planning and approval. The planning phase produces the rules of engagement. The final report describes the vulnerabilities found, presents a risk rating, and gives guidance on mitigating them.
Risk levels
Scanners each use their own severity levels, and those levels may not match the real risk. SP 800-115 gives the example of an FTP server flagged for cleartext passwords that is only used anonymously with no passwords. Assessors should set the risk level themselves rather than accept the scanner's.
Where the exam catches people
Believing a second scanner confirms a finding: it often repeats the same false positive; manual examination is more accurate.
Believing a scan proves a flaw is exploitable: only an exploit attempt, as in a penetration test, verifies it.
Believing several low-risk findings are always low risk together: combined they can be higher risk, which penetration testing shows and scanners do not.
Believing a scanner's severity label is the organization's risk: assessors should set the risk level for their own environment.