Pentest vs Vulnerability Scan: Which Should You Choose?

"Should we do a pentest or a scan?", the question comes up at every security committee. The answer isn't one or the other, but the right combination at the right time. Too many organizations commission an annual pentest for EUR 15,000 and think their security is covered. It isn't. But automated scanning alone isn't enough either.

The pentest: the simulated attacker

A penetration test is performed by one or more human pentesters who simulate a real attack on your system. They use the same tools and techniques as actual attackers.

What pentesting delivers

• Human creativity: the pentester chains minor vulnerabilities to achieve major impact. A CORS misconfiguration + stored XSS + a cookie missing the HttpOnly flag = admin session exfiltration. A scanner doesn't make that chain.

• Business context: the tester understands that access to patient data is more critical than access to the "About" page. They prioritize by real impact.

• Proof of exploitation: not just "this vulnerability exists" but "here's what an attacker actually does with it." That changes the conversation with leadership.

• Logic testing: horizontal privilege escalation (accessing another user's data), business workflow bypass. No scanner tests this.

Pentest limitations

• High cost: EUR 5,000 to 30,000 depending on scope (simple web app vs full infrastructure). A Red Team engagement can reach EUR 50,000 to 100,000.

• Point-in-time: a snapshot at a given moment. The day after the pentest, a deployment can introduce a new vulnerability.

• Limited coverage: in 5 days, the pentester doesn't test 100% of your surface. They focus on the most promising vectors.

• Tester dependency: quality varies enormously between providers. A mediocre pentest gives a false sense of security.

• Frequency: most organizations do one pentest per year. 365 days of no visibility between tests.

Vulnerability scanning: the continuous safety net

Vulnerability scanning is an automated process that identifies known flaws on your systems by comparing them against CVE databases (NVD, VulnDB).

What scanning delivers

• Comprehensiveness: the scanner checks every port, every service, every package version. Where the pentester focuses, the scanner sweeps everything.

• Frequency: daily or weekly. You detect a new CVE on your Apache stack within 24 hours of publication, not 11 months later at the next pentest.

• Low marginal cost: once configured, additional scans cost nothing. Scanning 10 servers or 1,000 requires the same human effort.

• Standardized scoring: CVSS for technical severity, EPSS for real-world exploitation probability. EPSS has become essential: a CVE with CVSS 9.8 but EPSS 0.1% is less urgent than a CVE at CVSS 7.5 with EPSS 85%.

• History and trends: tracking vulnerability debt over time, MTTR (Mean Time To Remediate) metrics.

Scan limitations

• No creativity: scanning identifies individual vulnerabilities, not exploitation chains. It doesn't test business logic.

• False positives: scanners generate 20-30% false positives depending on environment. Without intelligent prioritization, it's noise.

• Known vulnerabilities only: if the CVE isn't in the database, the scanner won't find it. Zero-days, custom misconfigurations, logic flaws: invisible.

• No impact context: a vulnerability on an internal dev server doesn't have the same impact as an identical vulnerability on a production server exposed to the internet.

CVSS vs EPSS: changing the paradigm

CVSS (Common Vulnerability Scoring System) evaluates the technical severity of a vulnerability. EPSS (Exploit Prediction Scoring System) evaluates the probability it will be exploited in the next 30 days.

In 2026, prioritizing by CVSS alone is obsolete. Concrete example:

• CVE-2024-XXXX: CVSS 9.8 (critical), EPSS 0.04% - no known exploit, high exploitation complexity. Low priority.

• CVE-2024-YYYY: CVSS 7.2 (high), EPSS 92% - public exploit, actively exploited in the wild. Immediate priority.

ThreatClaw combines CVSS and EPSS to prioritize remediations. You fix what attackers are actually exploiting first, not what has the highest theoretical score.

When to choose what

Here's my decision guide:

• Continuous scanning (mandatory): for every organization, regardless of size. It's your permanent safety net. No excuse in 2026 for not scanning your infrastructure at least weekly.

• Annual pentest (recommended): for organizations with web applications, APIs, or complex environments. The pentest validates what scanning can't test.

• Semi-annual pentest: if you're in a regulated sector (finance, healthcare) or your attack surface changes frequently (continuous deployments).

• Red Team: if your maturity is sufficient (operational SOC, detection in place). Red Team tests detection and response, not just vulnerabilities. Useless if your monitoring is nonexistent.

ThreatClaw for continuous scanning

ThreatClaw's skills cover continuous scanning from every angle:

• Nmap: asset discovery and port scanning with NSE vulnerability detection scripts

• Trivy/Grype: Docker image scanning, application dependency and filesystem scanning

• OWASP ZAP: DAST scanning of exposed web applications

• Nuclei: 8,000+ community templates for web and infrastructure vulnerability detection

• Lynis: Linux hardening audit with scoring

Every finding is scored (CVSS + EPSS), contextualized (production vs dev, exposed vs internal), and prioritized. The result: a stream of actionable vulnerabilities, not a 500-page report you print and shelve. Start continuous scanning.

The optimal combined model

For an SMB/mid-market company, the most effective combination:

• Continuous: ThreatClaw for vulnerability scanning (infrastructure + web + containers), automated, daily

• Annual: application pentest by an external provider (focus on business logic, exploitation chains)

• At every major change: targeted scan after a significant deployment, cloud migration, or architecture change

Continuous auditing fills the gap between pentests. The pentest validates what automation can't test. The two reinforce each other.

FAQ

Can a vulnerability scan replace a pentest?

No. A scan identifies individual known vulnerabilities. A pentest tests real exploitation, attack chains, and business logic. A scan can find that Apache is running a vulnerable version. Only a pentester will discover that this vulnerability combined with a network misconfiguration grants access to the production database. Both are necessary.

What budget should I plan for a pentest?

Common ranges (2026): simple web application (USD 5,000-12,000), complex web app + API (USD 12,000-25,000), network infrastructure (USD 10,000-30,000), full Red Team (USD 35,000-120,000). Be wary of offers below USD 3,000: at that price, you'll get an automated scan disguised as a pentest.

How often should I scan for vulnerabilities?

Minimum weekly for infrastructure, at every build/deployment for applications. Internet-facing environments deserve daily scanning. With ThreatClaw, frequency is configurable per skill and per scope, with no additional cost tied to volume.

Is EPSS more reliable than CVSS?

They're two complementary metrics measuring different things. CVSS measures intrinsic technical severity. EPSS measures the probability of exploitation within 30 days. For patch prioritization, EPSS is more actionable because it reflects real-world risk. For compliance reporting, CVSS remains the standard. Use both together.