Vulnerability Assessment vs. Penetration Testing: What's the Difference?

Ask five IT providers the difference between a vulnerability assessment and a penetration test and you will get at least three answers, and probably a quote for whichever one they happen to sell. The terms get used interchangeably on proposals, insurance forms and audit checklists, and that confusion costs businesses money in both directions: paying penetration-test prices for an automated scan, or believing a scan report proves they are secure.

The difference is simple once you see it. A vulnerability assessment is about breadth: finding, ranking and tracking known weaknesses across the systems in scope. A penetration test is about depth: showing what an attacker could actually achieve by exploiting selected weaknesses. One tells you which doors might be unlocked. The other tries the handles, walks through, and shows you how far into the building it got.

Why this matters more than it did two years ago

For most of the last decade, stolen passwords were the leading way attackers got into businesses. That has changed. In the breaches analyzed for Verizon's 2026 Data Breach Investigations Report, 31% started with the exploitation of a software vulnerability, overtaking stolen credentials as the top way in. In the 2025 report, the figure was 20%.

Canadian data points the same way. Statistics Canada found that among businesses affected by a cyber incident, the share reporting attacks that involved exploiting software, hardware or network vulnerabilities rose from 19% in 2021 to 25% in 2023. Over the same period, the amount Canadian businesses spent recovering from incidents doubled to roughly $1.2 billion.

Attackers are also faster. For years, Mandiant has tracked time to exploit, which it defines as the average time taken to exploit a vulnerability before or after a patch is released, across the vulnerabilities it analyzes. It was 63 days in 2018 and 2019, and five days by 2023. In its M-Trends 2026 report, Mandiant estimates that the mean time to exploit has fallen to minus seven days, which it says means exploitation is routinely occurring before a patch is even released. That is the growing problem of zero-day vulnerabilities: weaknesses attackers use before organizations can fix them, or even know they exist.

Meanwhile, defenders are getting slower. Tenable's analysis of the 2026 DBIR reports that, in the remediation data Verizon studied, the median time to patch rose from 32 to 43 days. When the gap between disclosure and attack is measured in days or less, knowing exactly what is exposed, and proving which of those exposures actually matter, is no longer something you can leave to once a year.

What is a vulnerability assessment?

NIST defines a vulnerability assessment as a systematic examination of an information system to "identify security deficiencies" and "determine the adequacy of security measures." In practice, a vulnerability assessment combines automated scanning, configuration review and professional analysis to identify security weaknesses across the systems in scope. A qualified assessor then validates the findings, evaluates the risks and helps prioritize what should be fixed. How much it finds depends on the scope, how complete your asset inventory is, the credentials provided and the methods used.

The analysis is the part most businesses miss. A scan is not an assessment. NIST's testing guide warns that vulnerability scanners "can have a high false positive error rate" and that results need to be interpreted by someone with networking and operating-system expertise. It goes further: assessors should determine the real risk of each finding "and not simply accept the risk levels assigned by vulnerability scanners." A 90-page PDF exported from a scanning tool and emailed to you is raw material, not a vulnerability assessment.

A proper vulnerability assessment includes:

• A complete asset inventory. You cannot scan what you do not know exists. Forgotten servers, old test environments and unmanaged cloud resources are exactly what attackers find first.
• Both unauthenticated and authenticated scanning. An unauthenticated scan shows you what an outsider sees. An authenticated (credentialed) scan logs in and finds missing patches and misconfigurations an outsider cannot see but an attacker who gets a foothold can. The CIS Controls recommend both. PCI DSS v4.0.1 also requires authenticated internal vulnerability scanning for applicable systems, with defined exceptions for systems that cannot accept credentials.
• Validation. Removing false positives and confirming findings before anyone spends time fixing them.
• Risk-based prioritization. Ranking findings by real-world risk to your business, not just the scanner's severity score.
• Remediation tracking. A record of what was found, what was fixed and what was accepted as a risk, tracked over time.

Severity is not the same as risk

Most scanners rank findings using CVSS, a 0 to 10 severity score. The problem is volume. Analyst Jerry Gamblin's review of the year counted 48,185 new vulnerabilities (CVEs) published in 2025, excluding rejected entries, a 20.6% increase on 2024. Nearly 19,000 of them (3,984 Critical and 15,003 High) were rated Critical or High. No team can treat 19,000 issues as urgent.

This is why experienced assessors prioritize using evidence of real-world exploitation rather than severity alone. The U.S. Cybersecurity and Infrastructure Security Agency maintains the Known Exploited Vulnerabilities (KEV) catalogue, a list of vulnerabilities with "reliable evidence" of active exploitation. The catalogue held more than 1,700 entries in mid-October 2026, and an analysis by Cyble reported by SecurityWeek found 245 vulnerabilities were added in all of 2025, a far smaller set than the tens of thousands of CVEs published each year. FIRST's Exploit Prediction Scoring System (EPSS) estimates how likely a vulnerability is to be exploited in the next 30 days. Neither tells you whether you run the affected software, whether it is exposed or how important the system is. Used alongside that knowledge of your own assets, exposure and existing controls, these tools help turn an unmanageable list into a short one your team can actually work through.

What is a penetration test?

A penetration test is a controlled, authorized attack. NIST describes it as a test in which assessors "attempt to circumvent or defeat the security features of a system", typically working under agreed constraints. Where a vulnerability assessment asks "what weaknesses exist?", a penetration test asks "what could someone do with them?"

The key difference is chaining. NIST's guide explains that scanners only detect "surface vulnerabilities", weaknesses that exist in isolation, and cannot find vulnerabilities that only appear through combinations of attack steps. It also warns that several low-risk vulnerabilities can present a much higher risk when combined, "leaving the assessor falsely confident." A skilled tester might combine several individually moderate weaknesses that no scanner would flag as urgent, such as insecure default Windows network settings, a weak service account password and a reused local administrator password, to demonstrate a path to higher privileges or even control of much of the network. Testers also find serious problems that scanners miss entirely, such as broken authorization and flawed business logic in applications.

Vulnerability assessment vs. penetration testing, side by side

The table below compares the two on the question each answers, method, typical findings, who performs it, frequency, false positives, output and cost.

A few of these rows are worth expanding on.

Who performs it. Vulnerability scanning is usually run continuously by your internal IT team or managed service provider. Penetration testing should be performed by qualified testers who are sufficiently independent of the people who build and maintain the systems. PCI DSS requires "organizational independence" for applicable tests, but permits qualified internal testers as well as external providers. The Canadian Centre for Cyber Security's control catalogue also recommends an independent testing team.

False positives. Vulnerability scans produce them by the nature of the method, which is why validation matters. Penetration tests generally involve more manual validation, which can reduce false positives. However, not every finding is fully exploited, particularly when doing so would risk disrupting production systems. A good report explains what was actually demonstrated and what remains a potential risk.

Risk to operations. Both can affect live systems. Penetration testing often carries greater operational risk because it may involve active exploitation, though the actual risk depends on the systems, tools and techniques involved. NIST notes that systems "may be damaged or otherwise rendered inoperable" during testing. Careful scoping, agreed rules of engagement and tested backups reduce that risk for both. They do not remove it.

How often should you do each?

The major frameworks agree on a pattern: frequent vulnerability scanning, with periodic penetration testing on top. The CIS Controls are security recommendations unless a contract, regulation or adopted standard makes them mandatory; PCI DSS requirements apply to organizations within its scope.

• Vulnerability scanning. The CIS Controls recommend internal scans at least quarterly and external scans at least monthly. For organizations subject to the relevant PCI DSS requirements, internal vulnerability scans are required at least every three months, with quarterly external scans by an Approved Scanning Vendor and further scans after significant changes.
• Penetration testing. Applicable PCI DSS requirements call for internal and external penetration tests at least every 12 months and after significant changes, covering the systems in scope. The exact obligations depend on your payment environment, so not every small business that accepts credit cards automatically needs its own annual penetration test. The CIS Controls recommend annual external penetration testing for organizations implementing the relevant safeguards, and annual internal testing for more mature organizations in Implementation Group 3.

NIST summarizes the logic well: a well-designed program of "regularly scheduled network and vulnerability scanning, interspersed with periodic penetration testing" can prevent many types of attacks and reduce the impact of the ones that succeed.

Our own advice is to pay particular attention to the edge of your network. Firewalls, VPN gateways and remote access systems are where attackers increasingly start. According to Tenable, a data contributor to Verizon's 2025 report, edge devices and VPNs accounted for 22% of the CVE-related breaches in that report, up from 3% the year before. Cyber insurer Coalition reported that 58% of the ransomware claims in its 2024 data began with attackers compromising perimeter security appliances such as VPNs and firewalls. That is claims data from one insurer, not all ransomware, but it points the same way. For anything internet-facing, quarterly is not frequent enough. We recommend continuous or at least monthly external scanning.

What does each cost?

Vulnerability assessment. Costs are mostly ongoing. For comparison, a commercial vulnerability scanner such as Tenable Nessus Professional costs several thousand dollars a year for the licence alone. The bigger cost is the expert time to deploy and run scans, validate and prioritize results, and track remediation, which is why many small and mid-size businesses get vulnerability management as part of a managed security service rather than buying tools and staffing it themselves.

Penetration testing. Costs are per engagement and depend on scope. Canadian testing firm Packetlabs puts the typical Canadian range at CA$5,000 to over CA$150,000, with the top end covering large enterprises and extended red team exercises rather than routine tests. Toronto-based Stingrai's 2026 benchmarks put a standard external network test at CA$15,000 to CA$35,000, and an entry-scope web application test at CA$5,000 to CA$12,000. Both are vendors whose guides reflect their own positioning, so treat these as indicative ranges rather than market data, and get two or three quotes on an identical scope.

One warning: a very inexpensive penetration test deserves closer scrutiny, but price alone does not establish quality. Some providers offer narrow or heavily automated engagements at lower cost. Ask exactly what is included: whether testing goes beyond vulnerability scanning, how findings are validated, whether manual analysis is involved and whether the report includes meaningful evidence. Then make sure the engagement meets your security and compliance needs.

Which one do you need?

In most cases, both. They answer different questions and do not replace each other. The useful question is which comes first.

For businesses without an established security program, a vulnerability assessment is often the practical first step. It builds an inventory, finds the obvious weaknesses and prioritizes remediation before you spend money on deeper testing. Paying a penetration tester to find missing patches a scanner would have found for a fraction of the cost is poor value.

Add a penetration test when your basic hygiene is in place and you need to know whether it actually holds up. A penetration test may be appropriate sooner when:

• you are subject to PCI DSS penetration-testing requirements,
• a client, insurer or auditor requires one,
• you supply a federally regulated bank or insurer. OSFI Guideline B-13 sets technology and cyber-risk expectations for these institutions, including regular vulnerability assessments and security testing, and they may pass relevant expectations to suppliers through contracts, due diligence or security questionnaires,
• you are launching or significantly changing a sensitive system, such as a new firewall, a cloud migration or a new customer-facing application.

Keep doing both after that. Continuous vulnerability management catches new exposures as they appear. An annual penetration test checks that the whole system, including your people and processes, holds up against someone actively trying to break in.

The bottom line

A vulnerability assessment identifies and prioritizes security weaknesses across your environment. A penetration test goes deeper, attempting to exploit selected weaknesses to demonstrate what an attacker could achieve. With attackers increasingly exploiting vulnerabilities before patches exist, most businesses benefit from both: ongoing visibility into their vulnerabilities, and periodic testing that puts their defences to the test.

Sources

1. Verizon, 2026 Data Breach Investigations Report, 2026.
2. Verizon, 2025 Data Breach Investigations Report news release, April 2025.
3. Statistics Canada, Impact of cybercrime on Canadian businesses, 2023, October 2024.
4. Google Cloud / Mandiant, How Low Can You Go? An Analysis of 2023 Time-to-Exploit Trends, October 2024.
5. Google Cloud / Mandiant, M-Trends 2026, March 2026.
6. Tenable, Key Findings from the Verizon DBIR 2026, May 2026.
7. NIST, Glossary: Vulnerability Assessment and Penetration Testing.
8. NIST, SP 800-115: Technical Guide to Information Security Testing and Assessment, 2008 (current edition).
9. Jerry Gamblin, 2025 CVE Data Review, January 2026.
10. CISA, Known Exploited Vulnerabilities Catalog, accessed October 2026.
11. SecurityWeek, CISA KEV Catalog Expanded 20% in 2025, Topping 1,480 Entries, January 2026.
12. FIRST, Exploit Prediction Scoring System (EPSS).
13. Center for Internet Security, CIS Controls Control 7 and Control 18.
14. PCI Security Standards Council, PCI DSS, v4.0.1, and Microsoft Learn's reproduction of PCI DSS v4.0.1 Requirement 11.
15. Tenable, Verizon 2025 DBIR: Tenable Research Collaboration, 2025.
16. Coalition, Cyber Threat Index 2025, March 2025.
17. Packetlabs, Guide to the Average Cost of a Pentest in Canada, updated December 2025.
18. Stingrai, Average Cost of a Pentest in Canada (2026), June 2026.
19. Tenable, Nessus Professional, accessed October 2026.
20. OSFI, Guideline B-13: Technology and Cyber Risk Management.