Skip to content

Pentest or vulnerability scan? What each one does, and when you need which

A vulnerability scan finds known vulnerabilities quickly and cheaply, with automated tools. A pentest is a manual attack by a tester: it finds what a scanner cannot see, such as broken access rights, logic flaws and chained weaknesses, and shows what an attacker could actually reach. Most companies need both, at different intervals.

See my fixed price

Prefer to talk first? Book a call

We offer both. If a scan is enough, we tell you.

Side by side. Both have their place.

How it works Vulnerability scanAutomated tools, ideally followed by a manual check of the results PentestA tester attacks by hand, supported by tools
What it finds Vulnerability scanKnown vulnerabilities: outdated software, missing updates, weak settings PentestAlso the unknown: access rights, business logic, chained weaknesses
False positives Vulnerability scanCommon in raw tool output; a manual check removes them PentestEvery finding is verified and backed by evidence
Shows real impact Vulnerability scanNo: it lists weaknesses, not what an attacker gets with them PentestYes: which data or systems an attacker could reach
Effort Vulnerability scanLow, usually done quickly PentestSeveral test days, depending on scope
Price at Mr Cyber Vulnerability scan€390 for up to 32 external IP addresses PentestExternal network pentest from €1,900, other tests at their own fixed price
Good for Vulnerability scanRegular checks, for example quarterly, and after changes PentestAudits, customer requirements, before a launch, at least yearly for important systems

When to choose which.

A scan is enough when …

  • you want a quick, affordable overview of your internet-facing systems
  • you want a regular check between two pentests
  • nobody has ever checked your external systems and you want to start somewhere

You need a pentest when …

  • an auditor, customer or insurer explicitly asks for a penetration test
  • you launch an application or roll out larger changes
  • your systems handle logins, customer data or payments
  • you need to know how far an attacker would really get

A common setup combines both: regular scans, plus a pentest of important systems at least once a year.

Both at a fixed price.

Pentest or vulnerability scan: FAQ

Is a vulnerability scan enough for ISO 27001 or NIS2?
Neither prescribes a specific method. A scan shows that you look for known technical vulnerabilities, which supports ISO/IEC 27001 Annex A 8.8. To show that your measures actually work, auditors usually expect a penetration test for important systems. More: NIS2 & Compliance and Pentest for ISO 27001.
Is a pentest just a more expensive scan?
No. A tester uses tools too, but the real work is manual: understanding the system, testing access rights and logic, combining weaknesses. That finds flaws a scanner cannot see, for example one customer opening another customer’s invoices.
Do scans produce false positives?
Yes. Raw tool output often contains hits that don’t apply to the actual system. That is why our vulnerability assessment includes a manual check of the relevant results, which removes false positives.
How often should we scan, and how often test?
Common practice is a scan at regular intervals, for example quarterly, and after changes, plus a pentest at least once a year and after significant changes.
Which one should we start with?
If nobody has ever checked your internet-facing systems, a vulnerability assessment is an affordable first look. If an audit or a customer asks for a pentest, a scan will not replace it. Not sure? A free 30-minute call clears it up, or see your fixed price straight away in the quote form.

Also useful: NIS2 & CompliancePentest for ISO 27001TISAX pentestPentest for cyber insurance

What should we test?

Pick one to start your request. You get your binding fixed price instantly, and the written offer (PDF) by email right after your request.

See my fixed price

Prefer to talk first? Book a call