Vulnerability Assessment vs Penetration Testing: What Each Finds, What Each Costs, and Which You Need First

A customer's security questionnaire lands on your desk. Line 14 asks for "your latest vulnerability assessment or penetration test report." Your insurer's renewal form asks something similar, in slightly different words. So which one do you buy, and does it matter?

It matters. The vulnerability assessment vs penetration testing question isn't about two names for the same service. They answer different questions, cost very different amounts, and satisfy different rules.

Short answer: a vulnerability assessment is a mostly automated scan that lists known weaknesses across many systems. A penetration test is a person attacking a defined scope to prove which weaknesses can actually be exploited and how far an attacker gets. In Canada in 2026, published guides put a scan-based assessment at about $2K to $5K and most penetration tests at about $5K to $45K. Most organisations need the assessment first, run it on a schedule, and add a penetration test once patching is under control or a customer, insurer or rule asks for one.

This guide covers what each one finds and misses, what each costs in Canadian dollars, how often Canadian rules and frameworks expect each, and a stage-by-stage answer to "which first." All prices are market figures from published guides, not an SMEnode quote.

Not sure where you stand? Our free IT and security assessment takes a couple of minutes and shows your biggest gaps before you spend anything on a scan or a test.

Vulnerability assessment vs penetration testing: what's the difference?

A vulnerability assessment asks: what known weaknesses exist across everything we own? A penetration test asks: if someone attacked this, what could they actually reach?

NIST's testing guide puts the line in one sentence. Vulnerability scanners "check only for the possible existence of a vulnerability," while the attack phase of a penetration test "exploits the vulnerability to confirm its existence" (NIST SP 800-115).

Here's the side-by-side:

Look at the "misses" row first. That's usually where the buying decision gets made.

What is a vulnerability assessment?

NIST defines it as a "systematic examination of an information system or product to determine the adequacy of security measures" and to "identify security deficiencies." In practice, that means scanning your systems against a database of known vulnerabilities, then having someone interpret what came back.

You'll also hear it called vulnerability testing. That second part is what separates an assessment from a scan. A scan is the tool's raw output. An assessment adds a person who removes false positives, ranks what's left and tells you what to fix first.

What does a vulnerability assessment find, and what does it miss?

It's good at the known stuff: missing patches, unsupported software, default settings, weak TLS, exposed management ports. NIST says scanning can "identify outdated software versions, missing patches, and misconfigurations."

It's weak in three places:

• False positives. NIST warns that although the process is highly automated, scanners "can have a high false positive error rate." Someone has to check.
• Custom applications. The Government of Canada's Guideline on Vulnerability Management (updated 2026-04-27) says commercial scanning platforms "typically cannot detect flaws in custom business applications." Those need targeted assessments and penetration testing.
• Context. A scanner sees a flaw on a server. It doesn't know that server holds your payroll export.

Here's a number worth sitting with. On 2026-11-08, the US National Vulnerability Database held about 421K CVE records. CISA's Known Exploited Vulnerabilities catalogue (version 2026.11.06) listed 1,769 that attackers are known to have used. That's fewer than half of 1%. So a scan report with 600 findings isn't 600 emergencies. The skill is finding the handful that matter. That's why the Canadian guideline's checklist has departments track the KEV list, EPSS scores and Cyber Centre alerts alongside their scan results.

Which vulnerability scanner tools do the work?

Most vulnerability assessment tools fall into four groups:

• Network and host scanners. Tenable Nessus, Qualys, Rapid7 and the open-source OpenVAS. Greenbone offers OpenVAS as a free community edition.
• Web vulnerability scanner tools. Tools such as OWASP ZAP and Burp Suite check web apps for injection, cross-site scripting and similar flaws.
• Cloud and container scanners. These check AWS, Azure and Google Cloud settings, container images and infrastructure-as-code files before they're deployed.
• Agents. Small programs on each laptop and server that report continuously, useful for devices that rarely sit on the office network.

What do the commercial ones cost? Tenable's own store lists Nessus Professional at just under US$4.8K a year (about $6.8K CAD at the Bank of Canada rate of 1.4113 on 2026-11-06) and Nessus Expert, which adds web app and external surface scanning, at about US$6.8K (about $9.6K CAD). Which is the best vulnerability assessment tool? Honestly, the one someone in your team reads every week. A free scanner with an owner beats a paid one nobody opens.

How do you do a vulnerability scan?

Here's the working order for a first scan:

1. List what you own. IP ranges, domains, cloud accounts, laptops, servers, network gear. You can't scan what you don't know about.
2. Get written approval. Even your own scan can trip alarms or slow an old system. Agree a window.
3. Scan from outside first. That's what the internet sees: firewall, VPN, email, web servers.
4. Then scan inside, with credentials. A credentialed scan logs in and reads installed versions. It finds far more and guesses less. CIS Controls v8.1 asks for both authenticated and unauthenticated internal scans.
5. Check and rank the results. Remove false positives. Put anything on the KEV list, exposed to the internet or sitting on a sensitive system at the top.
6. Fix, then rescan. The Canadian guideline's risk matrix sets 48 hours for critical findings, 14 days for high, 30 for medium and 90 for low. Those are federal targets, but they're a fair yardstick for anyone.
7. Repeat on a schedule. One scan is a snapshot. The value is in the trend line.

If you'd rather someone else runs that loop, that's what vulnerability management is: discovery, ranking, fixing and checking, on repeat, with someone accountable for the list getting shorter.

What is penetration testing, and what does it find that a scan can't?

A penetration test is an authorised, simulated attack. NIST describes testers who, "typically working under specific constraints, attempt to circumvent or defeat the security features of a system."

The big difference is chaining. NIST says penetration tests look for "combinations of vulnerabilities on one or more systems that can be used to gain more access than could be achieved through a single vulnerability." A scanner rates three medium findings as three medium findings. A tester uses them in sequence and walks out with domain admin. That's the finding your board actually cares about.

A test also shows whether anyone noticed. NIST lists "defenders' ability to detect attacks and respond appropriately" as one of the things testing can measure.

What are the three types of penetration testing?

Usually this means how much the tester knows going in:

• Black box: no inside information, like an outside attacker. Realistic, but slower, so you pay for discovery time.
• Grey box: a normal user login and some basic documentation. The most common choice for business apps, because it tests what a customer or staff member could do.
• White box: full access to documentation, credentials and sometimes source code. The deepest coverage per day of testing. CIS calls the two ends "clear box" and "opaque box."

You'll also see tests grouped by target: external network, internal network, web application, API, mobile, cloud, wireless and social engineering.

What are the 5 stages of penetration testing?

The common five-stage model is:

1. Reconnaissance: gather information about the target.
2. Scanning: find live systems, open ports and likely weaknesses.
3. Gaining access: exploit a weakness to get in.
4. Maintaining access: see whether the foothold can be kept and widened.
5. Analysis and reporting: write up what worked, what was reached and how to fix it.

That's an industry convention, not a standard. NIST SP 800-115 uses four phases instead: planning, discovery, attack and reporting, with reporting running alongside the other three. Either model is fine. What matters is that a firm can tell you which one it follows and show it in the report.

Why does a penetration tester need an attacker's mindset?

Because attackers don't follow your checklist. A scanner asks "is this patch missing?" An attacker asks "what's the easiest way to the money?" Often that's a forgotten test server, a shared admin password or a help desk process, none of which shows up as a CVE.

That mindset is what you're paying for. It's why CIS Controls v8.1 says penetration testing "requires specialized skills and experience and must be conducted through a qualified party."

What does each one cost in Canada in 2026?

These are published 2026 Canadian market ranges, not SMEnode prices:

The useful warning from the same guides: a "penetration test" quoted at CA$2K to CA$3K is, in one 2026 guide's words, almost always an automated scan. That's not a scam if it's labelled honestly. It's just a vulnerability assessment. The problem comes when it's sold as a pen test and your customer or assessor rejects it.

Why the gap between the two? Time and skill. A scan-based assessment is a day or two of tool time plus analysis. A penetration test is tester-days at a consulting day rate, plus reporting and a retest. Our penetration testing cost guide breaks that sum down by test type.

Vulnerability assessment vs penetration testing: which do you need first?

For almost everyone, the assessment comes first. A penetration test on an unpatched network spends paid tester-days proving what a scan would have told you for a fraction of the cost.

Two Canadian-relevant references agree on the order:

• The Cyber Centre's baseline controls for organisations with fewer than 499 employees recommend turning on automatic updates for all software and hardware. The Centre says plainly that its recommendations "differ from large enterprise recommendations, where we advocate for full vulnerability and patch management." Small firms can choose automatic patching or a full vulnerability and patch management programme.
• CIS Controls v8.1 puts a vulnerability management process, a remediation process and automated patching in its first tier, IG1, which CIS calls "essential cyber hygiene." Automated scanning and external penetration testing come in at IG2. Internal penetration testing is IG3.

So the sequence looks like this:

1. Patch automatically and know what you own. No scan or test yet.
2. Scan on a schedule and work the list down, starting with internet-facing systems and anything on the KEV list.
3. Add an external penetration test once a year, or when a customer, insurer or rule asks.
4. Add internal and application testing as you grow, store sensitive data or build your own software.

There's one big exception. If you build your own web app or API, test it before or soon after launch, even if you're small. Scanners don't understand your business logic, and the Canadian guideline says as much.

Three composite examples. They're not clients:

Picture a 25-person dental group in Mississauga. It runs Microsoft 365, a cloud practice management system and a handful of PCs. Step one is automatic patching, MFA and backups, per the Cyber Centre baseline. A quarterly external scan of its firewall and email domain is a cheap next step. A full penetration test can wait until an insurer or partner asks for one.

Picture a 120-person SaaS company in Ottawa selling to a bank. The bank's questionnaire asks for a penetration test of the product. Here the answer is both: continuous scanning of its cloud estate (CIS IG2) and an annual grey-box test of the web app and API, retested after fixes.

Picture a 300-person online retailer in Montreal that processes card payments on its own servers. PCI DSS sets the schedule: quarterly internal and external scans, the external ones by an approved scanning vendor, plus internal and external penetration testing every 12 months. Neither replaces the other.

If you're at stage 3 or 4, our penetration testing services page shows how we scope a test, report it and retest the fixes. If you're at stage 2, vulnerability management is the better fit.

How often do Canadian rules expect each one?

Only a few rules require either one outright. Here's what the main Canadian references say:

Two takeaways. First, the frequencies line up surprisingly well: scan monthly to weekly, test yearly and after big changes. Second, if you're a small private company outside payments and finance, no Canadian rule forces either one. The pressure comes from customers, insurers and contracts, and they're increasingly specific about which one they want.

Banks are the clearest case. OSFI doesn't give them a fixed schedule. It makes them set and defend their own, so they push testing requirements down to their suppliers through questionnaires.

What is VAPT, and is a combined test worth it?

VAPT stands for vulnerability assessment and penetration testing. It's one engagement where the scan runs first and the tester uses its results to pick targets. One 2026 Canadian guide puts VAPT at about $8K to $25K depending on scope.

The importance of VAPT is coverage plus proof. The scan covers breadth, every host in scope. The test covers depth on the parts that matter. You get one report that shows both the full list and the attack path.

Is it worth it? Yes, if you need a penetration test anyway and you haven't scanned recently, because the tester won't burn paid days on discovery. No, if you already run monthly scans. Then just buy the test and hand the tester your latest scan results.

How do you conduct a threat and vulnerability assessment?

A threat and vulnerability assessment is wider than a scan. It asks what you're protecting, who would attack it, how, and what weaknesses they'd use. The scan is one input.

A practical version:

1. List the assets that matter: systems, data and the business processes behind them.
2. Name the likely threats: ransomware crews, fraudsters, insiders, a supplier breach.
3. Find the weaknesses: scans, configuration reviews, interviews, and a penetration test where you need proof.
4. Rate the risk: likelihood times impact, in business terms.
5. Recommend and track fixes, with owners and dates.

Federal departments use the Harmonized TRA Methodology, which the Cyber Centre describes as tools "designed to address all assets, employees, and services at risk." For a private company, our threat and risk assessment service and our guide to a cybersecurity risk assessment walk through the same idea at business scale.

How do you choose vulnerability assessment services or a penetration testing firm?

Start with what you're actually being asked for. If the questionnaire says "penetration test," a scan report won't pass. If it says "vulnerability assessment," a full test is overkill.

Then ask any provider these questions. Treat it as a short vulnerability assessment questionnaire for the vendor:

1. Which tools do you run, and who reviews the output? You want a named analyst, not a raw export.
2. Do you scan with credentials? Without them, an internal scan misses most of what's installed.
3. How do you rank findings? Look for exploitation data (KEV, EPSS) and your business context, not CVSS score alone.
4. What methodology does the test follow? NIST SP 800-115, OWASP testing guidance or similar, named in the proposal.
5. What's in the report? An executive summary, each finding with evidence, and fix steps your team can act on.
6. Is the retest included? PCI DSS expects exploitable findings to be fixed and retested.
7. Can we see a sanitised sample report? If not, assume it's a scanner export.

For vulnerability assessment as a service, add one more: who acts when a new critical flaw lands between scheduled scans? The answer should be a person and a timeline.

A word on independence. Penetration testing service providers that also run your firewall can still test it well, but ask whether the testers are separate from the people who built the controls. The same applies to a managed security service provider offering both.

Quick answers

Is pentesting being replaced by AI?

Not the judgement part, not yet. AI is speeding up the scanning and recon stages, and some vendors now sell AI-assisted web app tests. But CIS still says testing "must be conducted through a qualified party," and a customer or assessor will want a named tester behind the report. Our guide to AI cyber security covers how attackers and defenders are both using these tools.

Can a vulnerability scan replace a penetration test for PCI DSS?

No. PCI DSS has separate requirements for scanning (11.3) and penetration testing (11.4). Where your self-assessment questionnaire includes both (SAQ D does; SAQ A, B and P2PE leave out 11.4), you need both, on their own schedules.

Do vulnerability assessment costs differ in Toronto, Ottawa or Montreal?

Not much. Scanning and most testing are done remotely, so scope matters more than city. On-site internal work adds travel. See our local pages for cybersecurity in Toronto, Ottawa and Montreal.

Bottom line

A vulnerability assessment tells you what's broken. A penetration test tells you what that means. Scan first, on a schedule, and fix what attackers are actually using. Add a penetration test once a year, after big changes, and whenever a customer, insurer or PCI DSS asks for one. Budget about $2K to $5K for a scan-based assessment and about $5K to $45K for most tests, and be wary of any "pen test" priced like a scan.

If you'd like a senior engineer to tell you which one you need right now, and what can wait, contact SMEnode.