Vulnerability assessment vs penetration test

These are different products with different prices and different buyers, and a large share of what is sold in Canada as a penetration test is the cheaper one with the more expensive name on the invoice.

Last reviewed 2026-08-27Written by Jacob Masse, TrazTech Inc.

A vulnerability assessment enumerates known weaknesses using automated tools and reports them by severity. A penetration test hires a person to attempt to exploit weaknesses, chain them together, and reach something that matters. The first is broad, repeatable, cheap and largely machine-driven. The second is narrow, expensive, and produces findings that only exist because somebody understood what your system was supposed to do. Both are worth buying. Neither substitutes for the other. Most Canadian buyers are sold the first and invoiced for the second.

The two products side by side

The hard part, said plainly

A scanner cannot find the flaws that cost companies money. It has no model of your business, so it has no idea that invoice 4192 belongs to a different customer than invoice 4191. Every serious finding of the last decade in a SaaS product has the same shape: an authenticated user reached data or an action that belonged to someone else. There is no signature for that. There is a person with two accounts and the patience to compare.

So when an engagement is priced at $2,500 CAD, divide it by a Canadian tester day, roughly $1,500 to $2,800. No version of that engagement includes a person mapping your authorization model. You are buying a scan, a triage pass and a document. That may be what you need. It should be named as what it is.

Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.

What a scan buys you, and what a test buys you

Both are worth money, for different reasons. The mistake that costs the most is buying one while believing you bought the other.

What a scan buys you

• Coverage of everything, cheaply and repeatedly. A scanner will look at ten thousand hosts as happily as at ten.
• Known vulnerabilities with public identifiers: unpatched software, expired certificates, weak TLS configuration, default credentials, exposed admin interfaces.
• A defensible answer to "do you scan for vulnerabilities", which is a real line in most questionnaires and in ISO 27001 Annex A.
• Trend data. Run monthly, the count going down is evidence your patching process operates, which is what an auditor wants to see.
• A cheap way to clear the easy findings before you pay a senior tester day rate to rediscover them.

What a test buys you

• Findings that could only exist in your product: one tenant reading another's records, a role check enforced in the interface and not in the API, an approval step that can be skipped by changing a value.
• Proof rather than possibility. A tester chains three medium issues into a real compromise and shows you the path, which a scanner reporting the same three issues separately never does.
• Verified findings. Somebody reproduced each one before writing it down, so your engineers are not spending a week chasing false positives.
• Independence a customer or an auditor will accept, from a named person who can be asked follow-up questions about the scope they covered.
• An artifact you can hand over: a report, and the attestation letter you send instead of it.

Neither list contains the other. For most companies the answer is both: scan continuously, test annually, and never let a supplier sell you the first while naming it the second. What happens after the test is the part buyers forget to purchase, covered on retest and remediation verification.

When a scan is the right purchase and a test is not

For some companies authenticated vulnerability scanning is the correct purchase this year and a penetration test is not. Telling them to spend $15,000 CAD anyway serves testing firms rather than buyers. If most of the following describe you, buy the scanner and put the difference into fixing what it finds.

• You have no product of your own. You resell or implement other people's software, and the only things with your name on them are a marketing site and a Microsoft 365 tenant. There is no authorization model to test because you did not write one.
• Nobody has asked. No customer contract, no auditor, no insurer names a test. Buying one speculatively is buying an artifact no one will read.
• You already know the answer. If you have never patched, never inventoried your external surface and have three servers whose owner left in 2023, a tester will spend day one telling you what a $200 CAD a month scanner tells you in an hour, and you will pay senior rates for it.
• Your last test's findings are still open. A second test before you have fixed the first one buys you the same report with a newer date on it.

The threshold that flips it is not headcount or revenue. It is the moment you hold data on behalf of somebody else in a system you built. From there a scanner cannot answer the question that matters, which is whether one customer can reach another customer's records. No scanning frequency substitutes. It is also the point at which customers start sending you security questionnaires that ask for a test by name.

What VAPT means, and why the word is a problem

VAPT stands for vulnerability assessment and penetration testing. As a phrase describing a program that includes both, it is the right shape for most companies. As the name of a single product on a price list, it is where the cheaper one absorbs the expensive one's name.

If a proposal is titled VAPT, ask for the split: how many tester days go to the manual testing portion, separately from the scanning. A firm doing both will answer immediately, because they costed it that way. A firm selling a scan answers in tools and coverage rather than days, which is the answer you were looking for.

Which one your requirement is actually asking for

How to buy both without wasting money

The arrangement that works for a company between twenty and two hundred people is scanning owned internally and running continuously, in the build pipeline and against production infrastructure, plus one scoped independent test a year against the product and whichever environment holds customer data.

Paying a consultancy to run monthly scanning is poor value. You are paying professional day rates for tool operation and a report you could generate. Outside help pays for itself in the first configuration, in tuning out the noise and in deciding which findings matter in your context. That is a few days of work once, not a retainer.

Spend the external budget on the independent manual test, which is the thing you cannot do yourself. What that engagement should contain is on penetration testing services. If the requirement is continuous coverage rather than an annual snapshot, pentest as a service is the model that tries to bridge the two.

If the term you were sold was VAPT, or another word used loosely in this market, the penetration testing glossary defines them the way a practitioner uses them.

Common questions