A board paper lands on the CISO's desk recommending "annual penetration testing" to satisfy ISO 27001 Annex A.8.8. The procurement team finds a vendor offering £1,200 "pen tests." Six weeks later, the report arrives: a PDF of Nessus scan output with severity ratings. That is not a penetration test. It is a vulnerability scan in a more expensive jacket — and when auditors, the ICO, or a real attacker comes calling, the gap will show.
This confusion costs UK organisations dearly. We see it across financial services firms scoping for FCA operational resilience (PS21/3), healthcare providers preparing for DSPT submissions, and SaaS companies chasing enterprise procurement. Buyers pay penetration testing prices for automated scanning, then assume they are covered. They are not.
The penetration testing vs vulnerability scanning question is not academic. It determines whether you find the chained exploit that ransoms your business, or whether you tick a box that an attacker laughs at. Below, our consultants break down the five critical differences every UK CISO, compliance lead, and security buyer must understand — and how to procure each correctly.
What vulnerability scanning actually is
Vulnerability scanning is automated. A tool — Nessus, Qualys, Rapid7 InsightVM, OpenVAS, Tenable.io — fingerprints assets, compares software versions against CVE databases, and reports known weaknesses. It runs in minutes to hours. It produces a list. That list is graded by CVSS score.
Done properly, scanning is continuous. It runs weekly or daily against the external perimeter, internal network, cloud configurations, and container registries. It catches the unpatched Exchange server, the exposed RDP port, the S3 bucket left public, the Log4j instance someone missed. It is essential hygiene. Without it, you are blind to known issues that attackers exploit within hours of CVE publication.
But scanning has hard limits. It finds known vulnerabilities in known CVE databases. It does not understand business logic. It will not chain three medium-severity findings into a full domain compromise. It will not notice that your password reset flow allows account takeover, or that your IDOR vulnerability exposes every customer's invoice. It reports symptoms, not exploitability in your specific environment.
This is the first trap: a clean scan report is not a secure environment. It is an environment with no known, signatured issues that the scanner could detect from outside the application logic.
What penetration testing actually is
Penetration testing is a human-led, objective-driven exercise. A qualified tester — ideally CREST CRT, OSCP, CHECK Team Member or Team Leader certified — attempts to compromise defined targets using the same techniques real attackers use. They chain vulnerabilities. They exploit logic flaws. They escalate privileges. They produce evidence of impact, not just lists of potential issues.
A real engagement includes reconnaissance, threat modelling against your specific architecture, exploitation attempts, post-exploitation (lateral movement, persistence, data exfiltration simulation), and a detailed report explaining the attack path, business impact, and remediation. It takes days to weeks per scope. It costs accordingly — typically £5,000 to £50,000+ depending on scope and complexity.
Good penetration testers find what scanners cannot: authentication bypasses, broken access controls, race conditions, server-side request forgery, deserialisation flaws, and the chains where five low-severity findings become one critical breach. They tell you which of your 2,000 CVE-flagged vulnerabilities actually matter in your environment, and which are unreachable behind compensating controls.
The five critical differences
1. Automation versus human creativity
Scanners pattern-match. Pen testers think. A scanner will report that your login page lacks rate limiting. A pen tester will use that to enumerate valid usernames, then password-spray against your Microsoft 365 tenant, then pivot through an over-privileged service account to your finance system. The scanner stops at finding number one. The attacker does not. Neither should your testing.
2. Breadth versus depth
Scanning covers everything, shallowly. Penetration testing covers a defined scope, deeply. You need both. Scan the entire estate continuously. Pen test the crown jewels — the customer portal, the payment system, the admin interface, the AWS production account — annually at minimum, and after every significant change. Treating them as substitutes is the most common procurement mistake we see.
3. Known versus unknown
Scanners find known CVEs. Pen testers find unknown business logic flaws, misconfigurations specific to your environment, and zero-day-adjacent issues in custom code. If you have built any bespoke application — and almost every UK SME has — scanning alone will miss the vulnerabilities most likely to harm you.
4. Cost and frequency
Scanning is cheap and continuous: licence fees of a few thousand pounds per year for most SMEs, running constantly. Penetration testing is expensive and periodic: a serious web application test starts around £8,000–£15,000 in the UK market. Scoping both correctly is a board-level conversation about risk appetite, not a procurement line item.
5. Compliance evidence value
ISO 27001:2022 Annex A.8.8 (Management of technical vulnerabilities) and A.8.29 (Security testing in development and acceptance) both expect testing, not just scanning. PCI DSS v4.0 explicitly requires both quarterly ASV scanning and annual penetration testing (Requirements 11.3 and 11.4). The DSPT for NHS-connected organisations expects penetration testing for higher-risk systems. Submitting scan reports where pen test evidence is required will fail audit. Our team has seen it happen.
The CREST and CHECK question
UK buyers should understand the two main quality marks. CREST (Council of Registered Ethical Security Testers) certifies both companies and individuals against assessed competence standards — CRT, CCT, and others. CHECK is the NCSC scheme used where testing involves UK government systems or HMG data; it requires CHECK Team Member or Team Leader certified testers working for a CHECK-approved company.
For most UK private sector engagements, CREST-certified testers from a CREST-accredited company is the right bar. For central government, MoD suppliers, or anything touching OFFICIAL-SENSITIVE data, CHECK is non-negotiable. Cheap "pen tests" from uncertified providers are almost always rebadged vulnerability scans. Ask for tester certifications by name before you sign.
Common procurement mistakes — and how to avoid them
Buying a scan and calling it a test. Read the statement of work. If the methodology section is three lines and the deliverable is "automated scan report," it is not a penetration test. Walk away.
Scoping too narrowly to hit a price point. A pen test of "the login page only" tells you nothing about your application's security. Scope around business risk: what would hurt most if compromised? Test that.
Treating the report as the outcome. The report is the start. Remediation, retest, and integration into your secure development lifecycle is the outcome. Budget for fix work, not just the test.
Annual cadence for fast-changing systems. If you ship to production weekly, an annual pen test is theatre. Combine continuous scanning, secure code review, and targeted pen testing after major releases.
Ignoring cloud configuration. Traditional pen testing often skips IAM policies, S3 bucket permissions, and serverless function configurations. These are now the most common breach vectors. Cloud security posture management belongs alongside both scanning and testing.
A practical procurement checklist
- Define the objective. "Find exploitable paths to customer PII" beats "test the website."
- Demand named, certified testers — CREST CRT/CCT or CHECK Team Member minimum.
- Require a methodology aligned to OWASP Testing Guide, OWASP ASVS, or PTES.
- Insist on a debrief call with the lead tester, not just account management.
- Build in a free retest of remediated criticals within 90 days.
How Pyralink helps
Pyralink Innovation Ltd, led by Michael Adedeji (CISM, CISA, CC, MSc Data Science), helps UK organisations scope, procure, and act on the right combination of vulnerability scanning and penetration testing. Our consultants do not sell pen tests — we help you buy them properly, interpret the findings, and remediate what matters.
For continuous visibility across AWS, Azure, and GCP, CloudAuditX identifies misconfigurations and compliance gaps that traditional scanners miss. Our fractional vCISO service (from £497/month) provides the senior oversight to integrate testing into your ISO 27001 programme, manage remediation, and present meaningful risk reporting to your board. Pyralink carries £5M professional indemnity cover. For deeper reading on adjacent topics, see our insights, or run the free compliance scanner to baseline where you stand.
Stop paying penetration testing prices for vulnerability scans. Get the right testing, at the right depth, for the right risks.