Vulnerability assessment vs penetration testing

These two terms get used interchangeably, but they answer different questions, and asking for the wrong one usually means paying for work that does not match what you actually needed.

Vulnerability assessment: breadth

A vulnerability assessment identifies, validates and prioritises known weaknesses across an agreed set of systems. It favours coverage — scanning and reviewing broadly so nothing obvious is missed. It is a good fit for a general health check, a compliance requirement, or a first look at an environment that has never been reviewed.

Penetration testing: depth

A penetration test starts from a goal — such as reaching sensitive data or an administrative function — and works to demonstrate whether that goal is achievable, chaining smaller issues together the way a real attacker would. It favours depth over coverage, and is a better fit once the basics are already in reasonable shape and the question is "can this actually be broken into."

Choosing between them

If you are not sure your environment has been looked at recently, start with a vulnerability assessment. If you already have reasonable controls and need to know whether a specific system or workflow can withstand a determined attacker, a penetration test is the right tool. Many engagements combine both: assessment first to establish a baseline, then targeted testing on the areas that matter most.