Penetration test vs vulnerability scan: which one your business needs, and when
Penetration test vs vulnerability scan: what each finds and misses, how often ASD expects scans, what insurers ask, and which your business needs first.
Penetration test vs vulnerability scan is rarely either/or: most Australian small and mid-sized businesses need both, on different clocks. Scan for known weaknesses at least monthly (more often under the Essential Eight), and run a penetration test about once a year, or after a big change, to prove what an attacker could reach. Short on budget? Start with scanning. Key IT runs both.
The question usually arrives because someone else asked it: an insurer's renewal form, a client's supplier questionnaire or an Essential Eight gap list.
How is a penetration test different from a vulnerability scan?
A vulnerability scan is software. It compares your devices and internet-facing systems with a database of known weaknesses and lists every match. NIST's technical guide to security testing (SP 800-115) calls a scanner a relatively fast and easy way to measure exposure to "surface vulnerabilities", meaning weaknesses that exist in isolation.
A penetration test is people. With your written permission, a tester attacks your systems the way a criminal would. NIST's definition notes that most tests hunt for combinations of weaknesses that together give "more access than could be achieved through a single vulnerability".
| Compared on | Vulnerability scan | Penetration test |
|---|---|---|
| Who does the work | An automated scanner, with a person checking the results | A skilled tester, using tools plus judgement |
| Question it answers | Which known weaknesses do we have right now? | Could someone break in, and how far would they get? |
| How long it runs | Seconds to minutes per device | Days or weeks, depending on scope |
| How often | A fixed cycle, from daily to quarterly depending on the framework | Usually yearly, and after major changes |
| Blind spot | Chained attacks; false positives | A snapshot that ages as your systems change |
| How it's usually bought | An ongoing service | A one-off project, priced by scope |
Run times are from the PCI Security Standards Council's penetration testing guidance.
What does a vulnerability scan find, and what does it miss?
Scanning is good at the boring, dangerous stuff. NIST lists outdated software, missing patches and misconfigurations as its core finds, and a perimeter scan adds whatever you've left exposed online, such as a firewall on old firmware. Being automated, it can run daily or weekly, which matters because new flaws appear constantly (see early threat intelligence). What it misses:
Chained weaknesses
NIST warns that scanners can't detect risks that only appear when flaws combine, and may rate each piece low, "leaving the assessor falsely confident".
Logic flaws in your own web apps, such as a client portal that shows one client another's documents.
People
No scanner knows whether your accounts team would approve a fake change of bank details.
Anything switched off
Network scans only see active systems.
Context
Results include false positives, so NIST says an expert in networking and operating system security should interpret them.
What does a penetration test find that a scan can't?
A good tester thinks in paths, not lists. Picture this chain (an illustration, not a client story): a printer on its factory password gives a foothold, a local admin password reused across laptops lets the tester move sideways, and a flat network puts the file server in reach. A scanner might rate each step low. The tester shows they add up to your client files.
Testing can also reach web app logic, leaky Wi-Fi, cloud sharing settings and, with your sign-off, staff who might hand over access to a convincing caller. The trade-off: a test covers one scope on one date, so next week's new flaw won't be in it.
How often should you run each?
For scanning, the clearest Australian benchmark is the Essential Eight. At Maturity Level One, ASD's Blueprint guidance on patching applications and patching operating systems sets these minimums:
| What | Scan at least | Patch within |
|---|---|---|
| Online services | Daily | 48 hours if critical or a working exploit exists; otherwise two weeks |
| Internet-facing servers and network devices (operating system) | Daily | 48 hours if critical or a working exploit exists; otherwise two weeks |
| Office suites, browsers, email clients, PDF software, security products | Weekly | Two weeks |
| Workstations, internal servers and internal network devices (operating system) | Fortnightly | One month |
"Critical" means rated critical by the vendor, and higher maturity levels tighten several windows. None of the eight strategies is penetration testing. Its successor, ASD Essentials, is different: iTnews reports it backs effectiveness ratings with evidence like independent tests and simulated exercises. The Essential Eight stays current meanwhile, and the changeover will likely take a year or two.
For penetration tests, the usual rhythm is yearly plus after significant change. PCI DSS, the card-payment standard, sets scans at least every three months and penetration tests at least every 12 months for systems in scope.
Who is asking for which?
| Who's asking | What they look for | Usually answered by |
|---|---|---|
| Essential Eight assessment | Scanning on the schedule above, plus proof patches landed in time | Scan and patch reports |
| Cyber insurer | Varies by insurer and business size | Often both; read the question |
| Card payments (PCI DSS) | Three-monthly scans and yearly tests for in-scope systems | Both, if in scope; your payment setup decides |
| APRA-regulated client | Controls tested by independent specialists | Ask which evidence they accept |
| Enterprise or government questionnaire | Whatever the question names | Match its wording (see questionnaires, decoded) |
Insurers. Questions can scale with size. Chubb's standard cyber proposal form (New Zealand edition, May 2026), written for businesses with revenue between $50m and $700m, asks whether external and internal penetration testing happens at least annually and how often you scan. Its short form for businesses under $50m asks about MFA, backups, endpoint protection and email security, but not about penetration testing or scanning. Check your own insurer's wording, and see our cyber insurance renewal checklist.
Finance clients. APRA's CPS 234 requires regulated entities to test their security controls through "a systematic testing program" run by "appropriately skilled and functionally independent specialists". Where a third party manages their information assets and they rely on its testing, they must assess whether that testing is thorough and frequent enough for the risk. Firms handling data for a bank, insurer or super fund can expect those questions to flow down.
Do I need a penetration test or a vulnerability scan?
| Your situation | Start with | Why |
|---|---|---|
| Nobody scans your systems today, or you're working towards Essential Eight Maturity Level One | Vulnerability scanning | A low-cost way to find known gaps, and what the framework asks for |
| An insurer or client wants a penetration test from the last 12 months | Penetration test | A scan report doesn't answer that question |
| You've launched a client portal or booking system | Web application penetration test | Logic flaws rarely show up in a scan |
| You've moved to the cloud, changed premises or merged | Penetration test, then ongoing scanning | A changed network is an untested network |
| You worry staff could be talked into handing over access | Social engineering test | Scanners test technology, not people |
What does a good report look like?
A good scan report is short: each finding shows a severity score (usually CVSS), whether it's internet-facing, who owns the fix and its re-scan date, with false positives removed. NIST advises judging each finding's real risk rather than accepting the scanner's rating. A raw export isn't a report; it's homework.
For a penetration test, PCI's guidance says "merely reporting lists of vulnerabilities" misses the point, and outlines a report with:
- a high-level summary of scope and major findings;
- scope, methods and limitations, such as set testing hours;
- a narrative of how the test progressed and what was reached;
- each finding with a risk ranking, affected systems and references such as CVE numbers;
- how to clean up after testing, such as removing test accounts, then a retest report once you've fixed the findings.
The red flag is scanner output with a new cover page. No attack narrative means you bought a scan.
How does Key IT deliver each?
Vulnerability scanning is a managed monthly service, delivered remotely Australia-wide from $149 a month, priced by your number of sites and endpoints. Key IT runs internal and perimeter scans, Key IT's 24/7 SOC service checks every result, and you get a prioritised remediation report, help with fixes and a re-scan to confirm. See managed vulnerability scanning.
Penetration testing is a scoped project: external and internal network, web application, Wi-Fi, social engineering or cloud configuration tests, run in five stages from written rules of engagement through reconnaissance, exploitation and a severity-ranked report to a retest. The price is fixed once scope is agreed; see penetration testing with Key IT. Whoever you choose, independence matters: APRA and PCI DSS both expect testers who aren't marking their own team's work.
Frequently asked questions
Can a vulnerability scan replace a penetration test?
No. A scan lists known weaknesses one by one; a penetration test shows whether they combine into a real break-in. If an insurer, client or regulator asks for a penetration test, a scan report won't answer that request. Key IT pairs monthly managed scanning with periodic testing, so testers spend their time on harder problems.
How often should a small business get a penetration test?
Yearly is the usual baseline, plus after significant change: a new client portal, a move to the cloud, new premises or a merger. PCI DSS sets that cadence for card-payment systems. Key IT scopes each test to the systems a business relies on, so a small office isn't sold a test built for a public web app.
Does the Essential Eight require penetration testing?
No. None of its eight strategies is penetration testing, but both patching strategies require a vulnerability scanner: at Maturity Level One, daily for online services and internet-facing servers, weekly for common office applications and fortnightly for workstations. Key IT's managed scanning runs monthly as standard; for a target maturity level, Key IT maps the scanning schedule that level needs.
Can a scan or penetration test disrupt our systems?
Done carelessly, yes. NIST notes that vulnerability scanning creates far more network traffic than a basic port scan, and some scanners carry denial-of-service checks that can disrupt devices, so those can be switched off. For penetration tests, Key IT agrees scope, off-limits systems and testing windows in writing first, and flags critical findings once confirmed.
Can you penetration test Microsoft 365?
Yes, within Microsoft's rules. Its security testing rules of engagement limit testing to your own tenant or assets you're explicitly authorised to test, and prohibit denial-of-service testing. Key IT's cloud configuration test reviews Microsoft 365 and Azure for settings a default setup can leave open, such as files shared too widely, loose access rules and storage exposed online.
How much does each cost?
Key IT's managed vulnerability scanning starts at $149 a month, priced by locations and endpoints, anywhere in Australia. A penetration test is priced by scope: how many systems, applications and test types are involved. Key IT fixes the price once scope is agreed, so you know the cost before testing starts.
Related services & guides
More insights
Offshore staffing data security
Offshore staffing data security for Australian businesses: your APP 8 and APP 11 duties, the…
Read article CybersecuritySMS Sender ID Register explained
SMS Sender ID Register explained: why branded texts and appointment reminders now show…
Read article Essential 8ASD Essentials replaces the Essential Eight
ASD Essentials, released 15 Oct 2026, will replace the Essential Eight.
Read articleBook your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.