24. Oct 2022

When it comes to cyber security testing, there are two types of testing that are often confused. Penetration testing and vulnerability assessments are two different types of tests, but all too often the difference between the two is disregarded. Knowing the difference, and what each testing type involves, means you can choose the testing type more suitable for your organisational needs.

Vulnerability assessments are the more basic of the two, with the majority of testing taking an automated approach. This type of testing looks to identify known vulnerabilities within your environment, with no active exploitation of any identified weaknesses. Administrative credentials are provided for this type of testing to allow for the full investigation of organisational systems. This type of testing is important for an organisation to gain an understanding of their security posture, and to identify any weaknesses in their policies and procedures that may be allowing for vulnerabilities to be introduced into the environment. Due to the automated nature of this testing, it is often more cost-effective than a full penetration test.

Penetration testing, on the other hand, adds the active exploitation and manual identification of vulnerabilities in order to demonstrate both the potential impact of successful exploitation, as well as the ability to chain multiple exploits together to compromise multiple organisational systems. Testing is often started from the context of a normal user with the aim to escalate privileges within the environment and move laterally around the network. Due to the high-skilled nature of this type of testing, the effectiveness of it is directly tied to the ability of the tester carrying it out, and so making sure you select the right company is crucial to ensure the findings within the report are representative of the true nature of the environment.