The terms penetration test and vulnerability scan are used interchangeably in a lot of procurement conversations. They are not the same thing. Buying a vulnerability scan when you need a penetration test is a common and expensive mistake. This article explains the difference, what each is appropriate for, and what a manual web application penetration test actually involves.

What a vulnerability scanner does

A vulnerability scanner sends automated requests to a target application and compares the responses against a database of known vulnerabilities. It is fast, repeatable, and good at identifying known CVEs, missing security headers, outdated software versions, and some common misconfigurations. It is not good at understanding how an application works. It cannot identify business logic flaws, authentication bypasses that require multi-step interaction, or vulnerabilities that only appear when two separate weaknesses are combined.

What a manual penetration test adds

A manual penetration test uses automated tooling to map the attack surface and then applies human analysis to the areas that warrant closer attention. The tester reads the application's code paths, understands the intended business logic, and looks for ways to subvert it. A classic example is an e-commerce application where the discount code validation happens client-side: a scanner will not catch this because the response looks normal. A tester who understands the application flow will find it in the first hour.

OWASP Top 10 and what it actually covers

The OWASP Top 10 is a useful framework for understanding the most common web application vulnerability categories. A good web application penetration test covers all ten categories through manual testing, not just the ones that automated tools can detect. This includes injection flaws, broken authentication, insecure direct object references, security misconfigurations, and the newer categories around server-side request forgery and software and data integrity failures that were added in the 2021 update.

When a vulnerability scan is sufficient

A vulnerability scan is appropriate for continuous monitoring of known CVEs across a large asset inventory, for quick checks after a software update, and as a first pass before a manual test to identify the obvious issues. It is not appropriate as a substitute for a penetration test when a customer, auditor, or certification body has asked for evidence of penetration testing. Most compliance frameworks specify manual testing explicitly.

What to ask a provider before you buy

Before commissioning a web application penetration test, ask the provider what percentage of the engagement is manual versus automated, whether findings are manually verified before they appear in the report, and whether the tester will have access to the application's documentation or source code. The answers will tell you quickly whether you are buying a manual test or a scanner report with a cover page.

Every web application penetration test at Swift Vaultgate is manual. Findings are verified before they go in the report. If you want to understand what a test of your specific application would cover, a scoping call is the right starting point.