Guide · choosing a test
Scan, assessment, pentest or red team?
A scan lists known weaknesses automatically. A penetration test tries to exploit and chain them, so you learn what an attacker could actually reach and whether your fix works. A red team tests whether anyone notices. Most organizations need frequent scans and at least one pentest a year.
Four kinds of test, side by side
| Test | What happens | What you learn | How often | Typical length |
|---|---|---|---|---|
| Vulnerability scan | An automated tool compares your systems with known weaknesses and misconfigurations. | Known issues, at scale. Many false positives; nothing is exploited or chained. | Weekly to quarterly. PCI DSS asks for quarterly internal and external scans (requirement 11.3). | Hours |
| Vulnerability assessment | A scan plus a person who removes false positives and ranks what is left. | A prioritised list of real issues, still mostly one at a time. | Quarterly or after major changes. | Days |
| Penetration test | A tester (or an AI agent with a person reviewing) tries to exploit weaknesses and chain them toward a goal, inside an agreed scope. | What an attacker could actually reach, with evidence, and whether the fix worked (retest). | At least yearly and after significant change (PCI DSS 11.4); many SaaS firms test each major release. | 1–4 weeks |
| Red team | An objective-based campaign, often covert, that may include phishing and physical access, to test detection and response. | Whether your team notices and stops a realistic attack, not a list of every weakness. | Yearly or less, once the basics are covered by testing. | Weeks to months |
Which one someone is asking you for
- A customer’s security questionnaire asking for a “penetration test report” wants a pentest by a third party, usually within the last 12 months, with a retest of the findings.
- PCI DSS asks for both: quarterly scans (11.3) and an annual pentest (11.4). See what each framework requires.
- A cyber insurer may ask for either; read the question. “Vulnerability scanning” and “penetration testing” are separate checkboxes on most forms.
- Your board asking “could we be breached?” is asking a pentest question. “Would we notice?” is a red team question.
Between scans and yearly tests sits automated and continuous penetration testing, which repeats attack paths more often than a person can.
Questions
Is a vulnerability scan the same as a penetration test?
No. A scan reports known weaknesses automatically; a penetration test tries to exploit and chain them to show what an attacker could reach. Auditors and customers asking for a pentest will not accept a scan report.
Do I need a red team or a penetration test?
Start with a penetration test. A red team tests whether your people and tools detect an attack; it pays off once the weaknesses a pentest would find are already fixed.
How often should I scan versus test?
Scan often (weekly to quarterly) and test at least once a year and after significant changes. Continuous or automated testing sits between the two.
Sources for this page
- NIST SP 800-115, Technical Guide to Information Security Testing and Assessment — Definitions of vulnerability scanning, penetration testing and their place in an assessment.
- PCI DSS document library, PCI Security Standards Council — Requirement 11.3 (quarterly vulnerability scans) and 11.4 (penetration testing).
How firms are chosen, what counts as "published" and how to send a correction: methodology.
Cite this page
Pentesting Firms. "Penetration test vs vulnerability scan vs red team: which one you need." Updated November 8, 2026. https://pentestingfirms.com/vs-vulnerability-scanning/