Pentest vs Vulnerability Scan: What's the Difference?
Vulnerability scans and penetration tests both find security problems, but they answer different questions. Learn when each fits and why scans fall short.
Infrastructure testing
External Network Penetration Testing
We look at your perimeter from the outside, find what's exposed, and prove which weaknesses an attacker could actually use.
- PTES
- NIST SP 800-115
Overview
Your perimeter is whatever an attacker can reach from the internet, and it is rarely just what’s in your architecture diagram. Old staging servers, forgotten admin panels, unpatched VPN appliances and stale DNS records tend to accumulate over time.
We find what you expose, confirm which weaknesses are real, and show how an attacker could use them. Every finding is manually validated, so your team spends its time on genuine risks rather than scanner noise.
Scope
What we test
- Discovery of internet-facing hosts, ports and services
- Exposed administration and management interfaces
- VPN gateways and remote access services
- TLS configuration and certificate hygiene
- Default, weak or reused credentials on exposed services
- Known vulnerabilities, validated manually rather than reported from a scan
- Web servers and applications reachable from the internet
- DNS configuration and subdomain exposure
- Email security records (SPF, DKIM, DMARC)
- Remote desktop, SSH and file transfer services
Findings
Common issues we find
Generic examples of what this kind of testing tends to uncover. Every engagement is different, and we never share client findings.
High
Forgotten admin panels on the internet
Management interfaces, dashboards or staging sites that should only be reachable internally.
Critical
Unpatched edge devices
VPN appliances, firewalls or gateways missing security updates with public exploits available.
High
Default or weak credentials
Services still using vendor defaults or guessable passwords, often without login rate limiting.
High
Remote access without MFA
VPN, RDP or webmail logins protected by a password alone.
Low
Outdated TLS configuration
Legacy protocol versions, weak cipher suites or expired certificates on public services.
Medium
Missing or weak email authentication
SPF, DKIM or DMARC records missing or set to monitor only, making your domain easy to spoof.
Medium
Dangling DNS records
Subdomains pointing to cloud resources that no longer exist and could be claimed by someone else.
Severity shown is typical, not fixed. We rate each finding on its real impact in your environment.
Approach
How we test it
Confirm the scope
We agree the IP ranges, hostnames and domains in scope, check you have authority to test them, and set the testing window.
Discover the attack surface
We enumerate hosts, services and subdomains and compare what we find against what you expected to be exposed.
Validate by hand
Scanner output is a starting point. We confirm each potential issue manually and discard false positives before anything reaches the report.
Exploit safely
Where a weakness is real, we demonstrate its impact without disrupting the service, and alert you straight away if we find something critical.
Deliverables
What you receive
Every finding comes with proof-of-concept evidence, so your engineers can reproduce it and your auditors can trust it.
Executive summary
A plain-English view of risk for leadership, boards and customers.
Technical findings
Each issue with impact, evidence, reproduction steps and a clear fix.
Free retest
Once you’ve fixed the findings, we retest them and update the report.
Attestation letter
A letter you can share with customers and auditors to show testing was done.
Preparation
What we need from you
We'll confirm the details during scoping. Having these ready helps testing start on time.
- The list of IP ranges, hostnames and domains in scope
- Confirmation that you own or have authority to test each target
- Notice of any third-party hosting whose policy requires notification
- An agreed testing window and an emergency contact
- Our source IP addresses allowed through any blocking you want to bypass, if agreed
FAQ
External Network testing questions
Isn't an external test just a vulnerability scan?
No. Scanning is one early step. We validate every potential issue by hand, remove false positives, chain weaknesses together and show the real-world impact. That's what makes the report useful as evidence.
Will testing take our services offline?
We don't run denial-of-service tests, and we use safe techniques against production systems. If anything could carry a risk of disruption, we agree it with you first.
Should you test from outside our firewall or with it bypassed?
Usually both perspectives are useful. Testing as a real attacker shows what your defences block today. Allowlisting our addresses shows what's behind those defences if they're ever bypassed. We'll recommend an approach during scoping.
What if some of our hosts are in the cloud?
Cloud-hosted public IPs are tested the same way, within each provider's testing policy. For deeper testing of IAM and cloud configuration, see our cloud security testing service.
Guides and free tools
SPF & DMARC Record Builder
Build valid SPF and DMARC DNS records for your domain, with a plain-English explanation of every tag.
Runs in your browser
security.txt Generator
Create an RFC 9116 security.txt file so researchers know how to report vulnerabilities to you.
Runs in your browser
Related services
Internal Network & Active Directory Testing
Assumed-breach testing of your internal network and Active Directory, delivered remotely, to show how far one compromised laptop could go.
Cloud Security Testing (AWS, Azure, GCP)
Configuration review and authenticated attack-path testing of your AWS, Azure or GCP environment, focused on how small permissions become full control.
Web Application Penetration Testing
Manual testing of your web app's authentication, access control and business logic, the places scanners can't reach.
Need a pentest for an audit, a customer, or peace of mind?
Tell us what you need tested. You’ll get a fixed-fee proposal with tester-days and timeline stated, usually within a few days of the scoping call.