Both vulnerability scanning and penetration testing identify security weaknesses in your environment — but they're different tools for different purposes. Most small businesses need one. Some need both. Here's how to tell which applies to your situation.
Vulnerability scanning and penetration testing are frequently confused — sometimes deliberately, by vendors who use both terms interchangeably to make their service sound more comprehensive. They're meaningfully different in what they do, what they find, and what they cost.
Vulnerability Scanning: Automated, Continuous, Broad
A vulnerability scanner is an automated tool that checks your systems against a database of known vulnerabilities. It identifies open ports, running services, software versions, and compares them against CVE (Common Vulnerabilities and Exposures) databases to flag known security weaknesses. Tools like Nessus, Qualys, and Rapid7 InsightVM run continuous or scheduled scans across your environment and produce prioritised reports of identified vulnerabilities.
Vulnerability scanning is fast, scalable, and relatively inexpensive. It's excellent for: identifying missing patches, finding misconfigured services, spotting end-of-life software, and maintaining continuous visibility into your patch compliance. It's limited by its automation — it identifies known vulnerabilities based on version numbers and signatures, but doesn't actually attempt to exploit them or understand the real-world impact of findings in your specific environment.
Penetration Testing: Human-Led, Targeted, Deep
A penetration test (pentest) is a controlled, authorised attack on your environment conducted by a security professional. The tester uses vulnerability scanning tools as one input, but also applies human judgement, creativity, and attacker methodology — chaining vulnerabilities together, identifying logic flaws, testing business process weaknesses, and attempting to demonstrate actual impact (what could an attacker actually do if they got to this point?).
A pentest answers a different question than a vulnerability scan: not "what known vulnerabilities exist?" but "can we get in, and if so, how far can we go?" A vulnerability scanner might find a medium-severity vulnerability in isolation. A human tester might chain that medium-severity finding with two others to achieve admin access to your environment — demonstrating a critical real-world risk that the scanner's individual finding scores didn't reflect.
Penetration testing is significantly more expensive than vulnerability scanning (engagements typically range from $5,000 to $30,000+ depending on scope) and is point-in-time rather than continuous. It's appropriate when: you have compliance requirements mandating it (PCI DSS, some cyber insurance policies), you've recently made significant infrastructure changes and want to verify your security posture, or you want genuine assurance rather than just a compliance checkbox.
What Most NZ SMBs Actually Need
For most NZ small businesses, the priority is continuous vulnerability scanning as part of a managed IT service — ensuring that known vulnerabilities are identified and patched promptly. This provides ongoing, automated security hygiene at a manageable cost. Penetration testing becomes appropriate when a business has achieved a baseline of security hygiene and wants to test whether their controls actually hold up against a determined attacker.
A vulnerability scan tells you what's known to be broken. A penetration test tells you whether a determined attacker could get in and what the damage would be. Both are valuable — but in the right order, at the right time for your business's maturity.
