---
title: "Pentest or Vulnerability Scan? A Fair Comparison"
url: https://mr-cyber.com/pentest-vs-vulnerability-scan
language: en
description: "Pentest or vulnerability scan: what each one finds, what it costs and when you need which. A fair comparison, with fixed prices for both."
---

# Pentest or vulnerability scan? What each one does, and when you need which

A vulnerability scan finds known vulnerabilities quickly and cheaply, with automated tools. A pentest is a manual attack by a tester: it finds what a scanner cannot see, such as broken access rights, logic flaws and chained weaknesses, and shows what an attacker could actually reach. Most companies need both, at different intervals.

[See my fixed price](https://mr-cyber.com/quote)

Prefer to talk first? [Book a call](https://mr-cyber.com/contact#book)

We offer both. If a scan is enough, we tell you.

## Side by side. Both have their place.

| Aspect | Vulnerability scan | Pentest |
| --- | --- | --- |
| How it works   | Automated tools, ideally followed by a manual check of the results | A tester attacks by hand, supported by tools |
| What it finds   | Known vulnerabilities: outdated software, missing updates, weak settings | Also the unknown: access rights, business logic, chained weaknesses |
| False positives   | Common in raw tool output; a manual check removes them | Every finding is verified and backed by evidence |
| Shows real impact   | No: it lists weaknesses, not what an attacker gets with them | Yes: which data or systems an attacker could reach |
| Effort   | Low, usually done quickly | Several test days, depending on scope |
| Price at Mr Cyber   | €390 for up to 32 external IP addresses | External network pentest from €1,900, other tests at their own fixed price |
| Good for   | Regular checks, for example quarterly, and after changes | Audits, customer requirements, before a launch, at least yearly for important systems |

## When to choose which.

### A scan is enough when …

-   you want a quick, affordable overview of your internet-facing systems
-   you want a regular check between two pentests
-   nobody has ever checked your external systems and you want to start somewhere

### You need a pentest when …

-   an auditor, customer or insurer explicitly asks for a penetration test
-   you launch an application or roll out larger changes
-   your systems handle logins, customer data or payments
-   you need to know how far an attacker would really get

A common setup combines both: regular scans, plus a pentest of important systems at least once a year.

## Both at a fixed price.

-   [Vulnerability assessment Scan of up to 32 external IP addresses with a manual check, €390. Not a pentest.](https://mr-cyber.com/services/vulnerability-assessment)
-   [External network pentest A manual test of your internet-facing systems, from €1,900.](https://mr-cyber.com/services/external-network-penetration-testing)
-   [Web application pentest A manual test of your web application, from €2,900.](https://mr-cyber.com/services/web-application-penetration-testing)
-   [Pricing All fixed prices at a glance.](https://mr-cyber.com/pricing)

## Pentest or vulnerability scan: FAQ

Is a vulnerability scan enough for ISO 27001 or NIS2?

Neither prescribes a specific method. A scan shows that you look for known technical vulnerabilities, which supports ISO/IEC 27001 Annex A 8.8. To show that your measures actually work, auditors usually expect a penetration test for important systems. More: [NIS2 & Compliance](https://mr-cyber.com/nis2-penetration-testing) and [Pentest for ISO 27001](https://mr-cyber.com/iso-27001-penetration-testing).

Is a pentest just a more expensive scan?

No. A tester uses tools too, but the real work is manual: understanding the system, testing access rights and logic, combining weaknesses. That finds flaws a scanner cannot see, for example one customer opening another customer’s invoices.

Do scans produce false positives?

Yes. Raw tool output often contains hits that don’t apply to the actual system. That is why [our vulnerability assessment](https://mr-cyber.com/services/vulnerability-assessment) includes a manual check of the relevant results, which removes false positives.

How often should we scan, and how often test?

Common practice is a scan at regular intervals, for example quarterly, and after changes, plus a pentest at least once a year and after significant changes.

Which one should we start with?

If nobody has ever checked your internet-facing systems, a vulnerability assessment is an affordable first look. If an audit or a customer asks for a pentest, a scan will not replace it. Not sure? A free 30-minute call clears it up, or see your fixed price straight away in the [quote form](https://mr-cyber.com/quote).

Also useful: [NIS2 & Compliance](https://mr-cyber.com/nis2-penetration-testing)  [Pentest for ISO 27001](https://mr-cyber.com/iso-27001-penetration-testing)  [TISAX pentest](https://mr-cyber.com/tisax-penetration-testing)  [Pentest for cyber insurance](https://mr-cyber.com/cyber-insurance-penetration-testing)