Vulnerability assessment vs penetration testing cost: what you are actually buying
TL;DR
A vulnerability assessment finds known weaknesses in your attack surface using automated scanning. A penetration test proves whether those weaknesses are actually exploitable by chaining them together under controlled adversarial conditions. They answer different questions and should not be treated as interchangeable budget line items.
Vulnerability assessments cost $199 to $5,000 depending on scope and automation level. Penetration tests run $5,000 to $40,000+ for a scoped engagement. The price difference reflects hours of skilled manual exploitation work, not markup.
The counterintuitive finding from Vulnox assessment data: organizations with the cleanest vulnerability scan results are not necessarily the hardest to compromise. A network with zero critical CVEs and weak access control segmentation is more exploitable than a network with several medium CVEs and strong lateral movement controls.
Neither service catches insider threat, supply chain compromise, or social engineering at scale. Those three vectors account for the majority of actual breaches. Know what you are and are not buying before you sign a scope document.
There is a genuine open question the industry has not settled: at what organization size and risk profile does a vulnerability assessment stop being sufficient and a penetration test become necessary? Reasonable security professionals disagree, and the answer matters for how you budget.
The pentest that found nothing useful because the scope was wrong
A 60-person fintech company paid $22,000 for a black-box penetration test of their external perimeter. The scope was defined as their primary web application and the three IP ranges in their AWS environment. The pentest team spent five days running through OWASP Top 10 checks, attempting authentication bypasses, testing for injection vulnerabilities, and probing the network perimeter. Final report: two medium findings, both relating to security header misconfiguration. No critical or high findings. The CISO presented this to the board as a clean bill of health. Six months later, a contractor account that had never been offboarded was used to exfiltrate customer data from an S3 bucket that was not in the pentest scope because it was hosted under a legacy AWS account the security team had not listed in the asset inventory. The penetration test was technically accurate within its scope. The scope was wrong because the asset inventory was wrong. The $22,000 bought a test of the systems the company knew about. It told them nothing about the systems they had forgotten.
This is the core limitation that neither a vulnerability assessment nor a penetration test solves without a complete asset inventory going in. The quality of either service is bounded by the accuracy of what you put in scope. A vulnerability assessment that runs against an incomplete asset inventory produces an incomplete risk picture. A penetration test scoped against the wrong assets produces a clean report for the wrong environment.
What each service actually does technically
A vulnerability assessment runs automated and semi-automated tooling against a defined asset scope to identify known weaknesses: unpatched CVEs, misconfigured services, exposed management interfaces, weak TLS configurations, default credentials, outdated software versions. The output is a ranked list of findings with CVE references, CVSS scores, affected assets, and remediation guidance. Passive scanning collects information without sending traffic that would trigger detection — DNS enumeration, certificate transparency log analysis, WHOIS data, subdomain discovery. Active scanning sends probes directly to targets — port scanning, service fingerprinting, vulnerability signature matching. Neither phase involves exploitation. The scanner finds the open door. It does not walk through it. A penetration test starts where the vulnerability assessment ends. A skilled tester takes the findings from reconnaissance and scanning and attempts to chain vulnerabilities together into a path to a defined objective: domain admin, database access, customer data exfiltration, lateral movement to a specific system. This requires manual judgment at every step. An automated scanner will find that a service is running an outdated Apache version. A penetration tester will determine whether that version is exploitable in this specific environment, whether a successful exploit leads anywhere meaningful, and whether the exploit can be chained with a misconfigured IAM role and a weak internal DNS configuration to reach the crown jewel asset. That chain-building is the work that takes time and costs money.
Example
In a Vulnox vulnerability assessment using passive and active tooling, discovery of a wildcard domain scope typically surfaces three to five times more assets than the client's self-reported inventory. Subdomains running deprecated services, staging environments exposed to the internet, forgotten admin panels — these appear in the first passive scan pass and are frequently not in the client's asset tracking system. The active scan then fingerprints each discovered asset for known vulnerabilities. The deliverable includes an Asset Inventory, Risk-Ranked Findings, Compliance Mapping, and Remediation Guidance — structured for a security team to action without needing to interpret raw scanner output.
The distinction between authenticated and unauthenticated scanning matters significantly for cost and coverage. An unauthenticated external vulnerability assessment sees what an external attacker sees: your perimeter, your exposed services, your certificate infrastructure. An authenticated internal scan with credentials on the network sees misconfigurations, unpatched internal systems, and lateral movement paths that are invisible from outside. Most vulnerability assessment quotes default to unauthenticated external scope. If your threat model includes compromised insider accounts or supply chain access, you need authenticated scanning or an internal penetration test — and those are different scope and cost conversations.
Side by side across the dimensions that affect your buying decision
Scope and methodology
Vulnerability assessment: automated and semi-automated tooling against a defined asset list. Covers broad surface area efficiently. Finds known vulnerabilities by signature matching and configuration analysis. Does not attempt exploitation. Penetration test: manual adversarial testing against a defined objective. Narrower asset scope but deeper on each asset. Attempts actual exploitation and lateral movement. Requires a skilled tester making judgment calls throughout.
If you need to know the full shape of your attack surface and where your known vulnerabilities are, vulnerability assessment is the right tool. If you need to know whether a specific set of assets can be compromised by an attacker with a defined level of access, penetration test is the right tool. These are different questions.
Cost range
Vulnerability assessment: $199 to $5,000 depending on asset count, scan depth, and automation level. Automated platforms at the low end run broad external scans with structured reporting. Manual-assisted assessments with authenticated scanning and analyst triage run $2,000 to $5,000. Penetration test: $5,000 to $15,000 for a scoped web application test. $10,000 to $40,000 for an internal network penetration test. Red team engagements simulating a full adversary campaign run $25,000 to $100,000+. The cost is almost entirely labor: a senior penetration tester at $150 to $300 per hour, five to fifteen days of engagement time depending on scope.
For an SMB with limited security budget, a thorough vulnerability assessment at $199 to $2,000 covers more ground per dollar than a $15,000 penetration test with a narrow scope. For an organization that has already remediated its known vulnerabilities and needs to validate whether its controls actually hold under attack, the penetration test is the right next investment.
Output format and usability
Vulnerability assessment output: structured findings list with CVSS scores, CVE references, affected assets, and remediation steps. Designed for a security team to triage and action. Compliance mapping links findings to framework controls. Penetration test output: narrative report describing attack paths, proof-of-concept evidence, exploitation steps, and recommendations. Designed to be read by security leadership and used to justify remediation investment. Less actionable as a day-to-day work queue.
Vulnerability assessment output integrates into a security team's operational workflow. It produces a remediation backlog. Penetration test output is more persuasive to a board or an auditor because it demonstrates actual exploitability, not theoretical risk. Both have their place. The question is what you need to do with the output.
Regulatory acceptance
Most compliance frameworks — ISO 27001, PCI DSS, HIPAA, SOC 2 — require evidence of vulnerability management and risk assessment. A vulnerability assessment satisfies this requirement in most interpretations. PCI DSS specifically requires quarterly external vulnerability scans by an Approved Scanning Vendor (ASV) and annual penetration testing for environments in scope for cardholder data. HIPAA requires periodic technical and non-technical evaluation but does not mandate penetration testing specifically. ISO 27001 Annex A includes vulnerability management controls that a vulnerability assessment addresses directly.
For most compliance frameworks, a vulnerability assessment is sufficient for the technical security evaluation requirement. PCI DSS is the notable exception — it requires both. If your compliance driver is ISO 27001 or HIPAA, a vulnerability assessment satisfies the technical assessment obligation. If it is PCI DSS with cardholder data in scope, you need both and the penetration test is non-negotiable.
Re-assessment frequency and cost
Vulnerability assessment: designed for frequent re-assessment. Monthly or quarterly scanning is standard practice for organizations with active development pipelines, because new deployments introduce new attack surface. Automated platforms make this economically viable. Penetration test: annual or bi-annual for most organizations. The cost structure makes quarterly penetration testing impractical for all but the largest security budgets. Some organizations run automated vulnerability assessment monthly and manual penetration testing annually.
A layered approach — automated vulnerability assessment on a continuous or quarterly basis plus an annual penetration test — covers more ground than either service alone and is more cost-effective than quarterly penetration testing. The vulnerability assessment catches the fast-moving attack surface changes. The penetration test validates whether the residual risk after remediation is actually exploitable.
The numbers that put the cost conversation in context
3 to 5x
The number of assets Vulnox passive scanning typically discovers beyond a client's self-reported inventory during a wildcard domain vulnerability assessment. Subdomains running deprecated services, forgotten staging environments, and exposed admin interfaces show up in the first passive scan pass and are frequently absent from the client's asset tracking system. Vulnox assessment data, 2025.
$5,000 to $40,000
Typical cost range for a scoped penetration test engagement, driven almost entirely by senior tester labor at $150 to $300 per hour across five to fifteen days. Scope definition — what is in, what is out, what the objective is — is the single biggest cost lever before signing a statement of work.
$199
Vulnox automated vulnerability assessment covering wildcard domain discovery, passive and active scanning, risk-ranked findings, remediation guidance, executive summary, asset inventory, and compliance mapping. Full deliverable set with no manual analyst involvement required for standard engagements.
Zero
Critical or high CVEs found in the fintech company's $22,000 penetration test described above, six months before a contractor account exfiltration incident. Clean scan results do not mean low risk. They mean low known-vulnerability risk in the scoped environment. Those are different things.
What we actually see when scanning real environments
Assessment base: Vulnox vulnerability assessments, 2025, using passive discovery, active scanning, and compliance mapping across SMB and mid-market environments
The forgotten asset problem is worse than clients expect
In Vulnox vulnerability assessments using wildcard domain discovery, the gap between client-reported asset inventory and actual discovered attack surface averages 3 to 5 times more assets than reported. The most common categories of forgotten assets: staging and development subdomains left internet-exposed after project completion, admin panels running on non-standard ports not captured in DNS records, legacy services running on IP ranges that were transferred between teams without security review, and third-party integrations that created subdomains the security team never tracked. In one assessment of a 50-employee SaaS company, passive scanning discovered 23 subdomains. The client had listed 6 in their asset inventory. Of the 17 undocumented subdomains, 4 were running services with known CVEs rated high or critical. None of those 4 would have appeared in a vulnerability assessment scoped against the client's self-reported inventory. Vulnox assessment data, 2025.
A vulnerability assessment scoped against a self-reported asset list is not a vulnerability assessment of your actual attack surface. It is an assessment of the assets you remembered to list. Wildcard domain discovery as the first phase of any external assessment is not optional — it is the foundation that makes the rest of the scan meaningful.
Clean CVE results and weak access segmentation is a worse risk profile than high CVEs with strong segmentation
This is counterintuitive but consistent across Vulnox assessments. An environment with several medium and high CVEs on externally exposed services, combined with strong network segmentation, MFA enforcement, and minimal lateral movement paths, is harder to exploit to a meaningful objective than an environment with zero critical CVEs but flat network architecture, weak IAM policies, and overprivileged service accounts. The CVE score tells you about known vulnerability density. It does not tell you about exploitability in context. A critical CVE on a service with no path to sensitive data is a lower-priority finding than a medium CVE on a service with a direct path to a database containing customer PII. CVSS scores do not encode environmental context. Vulnox assessment data, 2025.
When evaluating vulnerability assessment output, CVSS score is a starting point for prioritization, not the end point. The remediation priority for any finding should account for the asset's exposure, the data it processes or has access to, and the lateral movement paths available from a compromised foothold on that asset. A risk-ranked findings report that re-orders raw CVE severity by environmental context is more useful than a raw CVSS list.
Compliance mapping reveals framework gaps that pure security scanning misses
Vulnox vulnerability assessment deliverables include a Compliance Mapping document that links scan findings to specific framework controls — ISO 27001 Annex A, PCI DSS requirements, HIPAA technical safeguards. In assessments where clients are also working toward a compliance framework, this mapping consistently surfaces control gaps that the security team was not aware of. The most common example: a vulnerability scan finds that TLS 1.0 and 1.1 are still enabled on several services. The security team knew this was on the remediation backlog. The compliance mapping shows it also constitutes a PCI DSS 4.0 non-compliance finding and an ISO 27001 A.8.24 cryptography control gap. The same finding is now a security issue, a PCI finding, and an ISO finding simultaneously. Without the compliance mapping, the team would have triaged it as a medium-severity security finding. With it, it becomes a compliance-blocking issue that jumps the remediation queue. Vulnox assessment data, 2025.
If you are running a vulnerability assessment for a company that is also working on a compliance certification, the compliance mapping layer is not optional. It changes the remediation prioritization by connecting technical findings to compliance obligations that have deadlines and audit consequences.
What neither service catches
Insider threat
Both vulnerability assessments and penetration tests model external or semi-external threat actors. A vulnerability assessment scans your perimeter and known internal assets for weaknesses an outsider could exploit. A penetration test simulates an attacker who has gained initial access from outside. Neither service models a malicious or compromised insider with legitimate credentials and intentional data access. The fintech example above — a contractor account used to exfiltrate data from an S3 bucket — is insider-pattern behavior. It would not have appeared in any vulnerability scan or standard penetration test because there was no vulnerability to find. The access was legitimate. The risk was in the absence of access review, not in a misconfigured service.
Supply chain and third-party access
If a third-party vendor has API access to your environment, their security posture is part of your attack surface. Vulnerability assessments scan your assets. They do not scan your vendors' assets or evaluate the security of the integration points between your environment and theirs. A penetration test scoped to your environment will not test whether a compromised vendor credential could access your systems through a legitimate integration. This requires a dedicated third-party risk assessment or supply chain security review — a different engagement than either service discussed here.
Social engineering at scale
Phishing, vishing, and pretexting are responsible for a substantial proportion of initial access in real breaches. A vulnerability assessment does not test human susceptibility. A standard penetration test may include a phishing simulation if explicitly scoped, but this is typically a limited test of a defined group rather than a systematic assessment of organizational susceptibility. If your threat model includes targeted spear-phishing against executives or finance staff — a realistic threat profile for any company above $5M revenue — neither a vulnerability assessment nor a standard pentest addresses it.
Where the market for these services is heading
Automated vulnerability assessment will become a commodity included in cyber insurance underwriting within three years, fundamentally changing who pays for it and how often it runs.
Cyber insurers are already requiring evidence of vulnerability scanning as a condition of coverage. The next step is insurers running their own automated scans against applicant environments as part of underwriting — not asking for a report, but generating one directly. Several insurers are already moving in this direction. When this becomes standard underwriting practice, the question of 'do I need a vulnerability assessment' becomes moot for any organization carrying cyber insurance. The assessment runs whether you commission it or not. The only question is whether you see the results before the insurer does and have time to remediate before renewal.
Confidence: highIf two or more top-10 cyber insurers publicly announce automated perimeter scanning as a standard underwriting step within 24 months, the transition is underway. Watch for announcements from Coalition, At-Bay, or Corvus, which are already the most technically sophisticated underwriters in the market.The penetration testing market will bifurcate into high-value adversary simulation for enterprises and automated 'pentest-as-a-service' for SMBs, with the middle market disappearing.
The economics of manual penetration testing do not scale to the SMB market at current labor costs. A $10,000 minimum engagement price excludes most companies under 100 employees. At the same time, automated exploitation platforms — tools that attempt to chain vulnerabilities autonomously rather than just identify them — are improving rapidly. The gap between 'automated scanner' and 'manual tester' is narrowing from the bottom. Within five years, an automated platform will reliably perform the exploitation chain-building that currently requires a senior tester for the majority of SMB environments, which are not novel or complex enough to defeat automation. The high end of the market — red team engagements against sophisticated enterprise environments with custom detection and response capabilities — will remain human-driven because those environments are specifically designed to defeat automated tooling. The middle — a $15,000 scoped pentest of a standard cloud environment — will be displaced by automated alternatives at a fraction of the cost.
Confidence: mediumIf automated exploitation platforms achieve a documented critical finding rate within 20% of manual pentest results on standardized benchmark environments within three years, and if mid-market pentest firms report revenue decline in the $5,000 to $20,000 engagement range, the bifurcation is occurring.
The honest answer to when you actually need a penetration test
Most SMBs under 150 employees that have never run a vulnerability assessment should not buy a penetration test first. I know that is not what a penetration testing firm will tell you, but it is what the data supports. A penetration test on an environment with an incomplete asset inventory, unpatched known CVEs, and no prior external scanning is going to find exploitation paths that a vulnerability assessment would have flagged at a fraction of the cost. You are paying a senior tester $200 an hour to manually confirm what automated scanning would have told you for $200 total. The right sequence is vulnerability assessment first, remediation of critical and high findings, then penetration test to validate whether the residual attack surface is actually exploitable. The penetration test is most valuable when the low-hanging fruit is gone. When TLS 1.0 is still enabled and default credentials are still in place, you do not need a human to tell you those are problems. Run the scan. Fix what it finds. Then pay for the adversarial validation.
Counterargument
The strongest counter to this is that a penetration test motivates remediation in a way that a vulnerability report does not. A 200-finding vulnerability report gets triaged, deprioritized, and largely ignored within a month in most organizations. A penetration test report that says 'we exfiltrated your customer database in four hours' gets executive attention and budget that a scanner output never will. If the organizational problem is not knowledge of vulnerabilities but willingness to fix them, the penetration test's persuasive value justifies its cost even when the findings could have been predicted from a vulnerability assessment. That is a real argument and I have seen it be true.
The scope conversation to have before you spend anything
Before you sign any scope document for either service, ask the provider one specific question: what happens if your scanning discovers assets that are not in the scope I defined? If the answer is 'we report only what is in scope,' you are buying an assessment of your known environment. If the answer is 'we flag the discovered assets and include them in the findings,' you are buying an assessment of your actual environment. Those are different products. For a vulnerability assessment, the asset discovery phase is not a nice-to-have — it is what makes the rest of the assessment honest. Get that question answered before you finalize scope and budget.
Further Reading
HIPAA Risk Assessment
HIPAA Risk Assessment vs. Standard VA: Key Factors Comparedransomware response 2026
Your Company Just Got Hit by Ransomware: What NowVulnox Service
digital footprint analysisOWASP
OWASP web security resourcesSANS Institute
SANS Institute security training and researchNIST Computer Security Resource Center
NIST computer security resources
Frequently Asked Questions
What is the difference between a vulnerability assessment and a penetration test?
A vulnerability assessment uses automated and semi-automated tooling to identify known weaknesses across your attack surface — unpatched CVEs, misconfigured services, weak TLS, exposed admin interfaces. It does not attempt exploitation. A penetration test takes the findings from scanning and attempts to chain vulnerabilities together into an actual attack path toward a defined objective. The assessment finds the open doors. The penetration test walks through them and shows you where they lead. They answer different questions and serve different purposes in a security program.
How much does a vulnerability assessment cost?
Automated vulnerability assessments run $199 to $2,000 depending on asset scope and depth. The Vulnox vulnerability assessment is $199 and covers wildcard domain discovery, passive and active scanning, risk-ranked findings, compliance mapping, asset inventory, remediation guidance, and an executive summary. Manual-assisted assessments with authenticated scanning and analyst triage run $2,000 to $5,000. The price difference reflects analyst time for manual triage and interpretation, not a meaningfully different underlying toolset.
How much does a penetration test cost?
A scoped web application penetration test runs $5,000 to $15,000. An internal network penetration test runs $10,000 to $40,000. Red team engagements simulating a full adversary campaign run $25,000 to $100,000+. Cost is driven almost entirely by senior tester labor at $150 to $300 per hour across five to fifteen days of engagement time. Scope definition is the biggest cost lever before signing a statement of work — a precisely defined objective with a narrow asset scope costs significantly less than an open-ended engagement.
Does a vulnerability assessment satisfy PCI DSS requirements?
Partially. PCI DSS requires quarterly external vulnerability scans by an Approved Scanning Vendor (ASV) — a vulnerability assessment satisfies this. It also requires annual penetration testing for environments in scope for cardholder data — a vulnerability assessment does not satisfy this. If your environment processes, stores, or transmits cardholder data, you need both services. The penetration test is non-negotiable for PCI DSS compliance in that scope.
Should I run a vulnerability assessment or penetration test first?
Vulnerability assessment first, for almost every organization that has not done systematic external scanning before. A penetration test on an environment with unpatched known CVEs and incomplete asset inventory spends expensive manual tester hours confirming what automated scanning would have found for a fraction of the cost. The right sequence: vulnerability assessment, remediate critical and high findings, then penetration test to validate whether the residual attack surface is exploitable. The penetration test is most valuable when the known vulnerabilities are already addressed.
What does a vulnerability assessment miss that a penetration test would find?
Exploitation chains — paths where two or three individually low-to-medium findings combine into a critical attack path. A vulnerability scanner identifies each component separately. A penetration tester chains them together manually and demonstrates the actual impact. A misconfigured IAM role plus an outdated library plus a weak internal DNS configuration individually score as medium findings. Chained together by a skilled tester, they may represent a path to domain admin. Neither service catches insider threat, supply chain compromise, or social engineering — those require different assessment types entirely.
How often should a vulnerability assessment be run?
Monthly to quarterly for organizations with active development pipelines, because new deployments introduce new attack surface continuously. PCI DSS mandates quarterly external scans as a minimum. For organizations without a continuous deployment pipeline, quarterly is a reasonable baseline. Annual is the minimum for any organization that has internet-exposed assets. At $199 per assessment, the economic barrier to quarterly scanning is low enough that the question is really about remediation capacity — running scans faster than you can fix findings produces diminishing returns.
Related Articles
Your Company Just Got Hit by Ransomware: What Now
Ransomware in 2026 activates four simultaneous crises the moment it deploys: technical recovery, mandatory breach notification under GDPR and HIPAA, OFAC sanctions screening before any ransom payment, and cyber insurance obligations that condition coverage on timely notification. Most organizations have a technical response plan. Almost none have the parallel regulatory and legal response architecture that determines whether the incident becomes an enforcement matter.
Ready to Secure Your Digital Assets?
Get a comprehensive vulnerability assessment for your website today.