“Vulnerability scan”, “vulnerability assessment”, “penetration test” and “VAPT” are often used as if they mean the same thing. They do not. They differ in what they find, how much human effort goes into them, and what the result is worth to a customer or an auditor. Buying the wrong one is how organisations end up with a long report that nobody acts on, or with a false sense of security.
The short answer
| Activity | What it does | Output |
|---|---|---|
| Vulnerability scan | An automated tool checks systems for known vulnerabilities and misconfigurations. | A long list of potential issues, including false positives. |
| Vulnerability assessment | A person runs and reviews scans, removes false positives and prioritises what is left. | A validated, prioritised list of weaknesses. |
| Penetration test | A skilled tester tries to exploit weaknesses, alone and in combination, within agreed rules. | Proof of what an attacker could actually achieve, with evidence and fixes. |
| VAPT | A vulnerability assessment followed by penetration testing, in one engagement. | Both of the above, in a single report. |
What a vulnerability scan does, and does not do
A vulnerability scanner sends probes to your systems, identifies the software and versions running, and compares them against a database of known vulnerabilities and insecure settings. It is fast, repeatable and inexpensive, which is why it is a sensible thing to run regularly, monthly or even continuously.
But a scanner has clear limits:
- It reports what might be vulnerable, often based on a version number alone, so a significant share of results can be false positives.
- It does not understand your business, so it cannot tell that one customer being able to read another customer’s invoices is a serious problem.
- It looks at each issue in isolation. It cannot see that three “medium” findings together give an attacker administrative access.
- It stops at the login page unless it is carefully configured with credentials, and even then it does not test what each user role should and should not be able to do.
What a vulnerability assessment adds
A vulnerability assessment puts a person in charge of the scanning. They choose and configure the tools, review the output, remove false positives, and rank the remaining issues by real risk in your environment. The result is shorter and far more useful than raw scanner output. It is still largely about known vulnerabilities, though, and it does not try to exploit them.
What a penetration test adds
A penetration test asks a different question: not “what weaknesses exist?” but “what could an attacker actually do with them?”. A tester attempts to exploit weaknesses, carefully and within written rules of engagement, and follows the path wherever it leads.
Consider a typical example. A scan of an internal network reports a printer with default credentials (low risk), a file share readable by all staff (medium) and a service account with a weak password (medium). A penetration tester logs in to the printer and finds it stores the password of an account used for scan-to-email. That account can read the file share, which contains a script with the service account’s password, and the service account turns out to be a domain administrator. Three unremarkable findings become complete control of the network. Only manual testing shows that chain.
Penetration testing also covers what scanners cannot: business logic, authorisation between users and tenants, and the way systems trust one another.
So what exactly is VAPT?
VAPT, short for vulnerability assessment and penetration testing, is the term most often used in India in contracts, tenders and audit requests. It describes an engagement that combines both activities: broad discovery and validation of weaknesses, followed by manual exploitation to prove impact. When a customer asks you for a “VAPT report”, they almost always expect evidence of manual penetration testing, not just scanner output.
Where red teaming fits
A red team exercise is different again. Instead of finding as many weaknesses as possible within a scope, a red team pursues a specific objective, such as reaching a payment system, over a longer period, often using phishing and physical techniques, to test whether your people and monitoring notice and respond. It is valuable for organisations with mature security operations. Most organisations get far more from regular penetration testing first.
Which one do you need?
- You want ongoing hygiene between tests: run vulnerability scans regularly and fix what they find.
- A customer, auditor or regulator has asked for a VAPT or penetration test report: you need a penetration test with a clear scope and methodology statement. Scanner output will not satisfy them.
- You are launching a web application or API: you need an application penetration test, because the most damaging issues are in logic and authorisation, which scanners miss. See web application and API security testing.
- You want to know how far an attacker could get inside your network: you need an internal or assumed-breach penetration test.
- You have tested regularly and fixed the findings, and want to test your detection and response: consider a red team exercise.
How to tell what you are actually being offered
Some providers sell automated scans under the name “penetration test”. These questions help you tell the difference:
- Can you show me a sample report? Look for evidence and explanation, not just tool output.
- How much of the engagement is manual testing, and who carries it out?
- Are findings verified, and are false positives removed before the report?
- Will you test each user role, and how do you test business logic?
- Is a scope and methodology statement included, and is retesting available?
If a provider cannot answer these clearly, you are probably being offered a scan. That may be all you need, but you should know what you are paying for.