Czym rozni sie pentest od skanu podatnosci?

Skan podatnosci to zautomatyzowana lista znanych slabosci z ocena CVSS. Test penetracyjny to specjalista, ktory recznie proba je wykorzystac, laczy w sciezke ataku, testuje logike biznesowa i pokazuje realny skutek wraz z dowodem.

Czy skan podatnosci wystarczy do NIS2?

Zwykle nie. Tam, gdzie trzeba wykazac realna ocene ryzyka, wartosc ma raport z dowodami, ocena i planem naprawczym oraz retest po naprawie. Sam skan bywa elementem ciaglej higieny miedzy testami, ale nie zastepuje pentestu.

Insights / Testing

Penetration test vs vulnerability scan: what's the difference?

Updated: September 2026 · approx. 5 min read

A vulnerability scan is an automated list of "what could be wrong". A penetration test is a human who actually tries to exploit it and sees how far they get. You need both, but they answer different questions — and confusing them gets expensive at audit time.

The shortest comparison


	Vulnerability scan	Penetration test
Who runs it	Automated tool	Specialist, by hand + tools
Question	Which known vulnerabilities exist?	What can really be exploited, and with what impact?
Business logic	Not detected	Yes — abuse of processes, privileges, payments
False positives	Many — need verifying	Verified, with proof of concept
Output	List with CVSS scores	Report: attack path, risk, remediation plan
Frequency	Often, even continuous	Periodic and after major changes

When to use which

A scan is continuous hygiene: it catches known, newly disclosed vulnerabilities between tests — cheap and fast. A pentest verifies real risk: it chains vulnerabilities into an attack path, tests business logic and shows what an attacker actually achieves. A scan says "you have an outdated library". A pentest says "through that library I took over the admin account and customer data".

For audits and NIS2. A scan alone rarely suffices where you must show a real risk assessment. What counts is a report with evidence, scoring and a remediation plan — plus a retest after the fix that confirms the hole is actually gone.

How we do it

We test using OWASP ASVS and Top 10 (applications) and PTES (process), with a report covering the attack path, risk assessment and a concrete remediation plan. A retest after the fix is included. Scope and ranges are on the penetration testing page.

Not sure whether you need a scan or a full pentest? Tell us what you're protecting and we'll propose a scope matched to the risk, not to a price list.