What is the difference between a pentest and a vulnerability scan?

A vulnerability scan is an automated tool that lists known weaknesses. A pentest is a human who chains weaknesses into a real attack path and verifies impact. Both have a place; they are priced and used very differently.

How long does a pentest take?

Most engagements run one to four weeks of active testing plus a reporting phase. Compliance-driven web app pentests typically fit in two weeks.

How often should I get a pentest?

Annually at minimum for compliance, and on any significant change in scope — major release, new auth system, major refactor. High-trust environments test continuously.

What is included in a pentest report?

An executive summary, a methodology section, an inventory of findings with severity ratings, reproduction steps, evidence, and concrete remediation guidance for each finding.

Glossary · Security

What is Penetration Testing?

A penetration test (pentest) is a time-boxed, authorized, human-driven attempt to compromise the security of your systems by chaining vulnerabilities together the way a real attacker would, then writing down exactly what worked so your team can fix it.

What a pentest is not

A pentest is not a vulnerability scan. A vulnerability scanner is an automated tool that produces a list of known weaknesses without verifying impact or chaining anything together. Scans are useful, cheap, and continuous; pentests are slower, more expensive, and produce a real attack narrative. The cybersecurity industry has done a poor job protecting the word "pentest" — many vendors selling scan output now market it as a pentest because the price tag is higher.

A pentest is also not a one-and-done event that proves your environment is permanently secure. It is a snapshot of your security posture on the days the test ran, against the threat model the engagement scoped for.

What are the main types of penetration tests?

Web application pentesting targets your customer-facing apps and APIs. Network pentesting targets your perimeter (external) or internal corporate network. Mobile pentesting targets iOS and Android apps. Cloud pentesting targets misconfigurations in AWS, Azure, GCP. Active Directory pentesting targets your identity infrastructure. Most SaaS companies need a web application pentest first; companies with on-prem networks add network and Active Directory testing.

What is the difference between black-box, grey-box, and white-box pentesting?

Engagements are also categorized by how much the testers know going in. Black-box: testers start with nothing but the public target and have to discover everything themselves. Most realistic against an external attacker, slowest, and easy to miss things buried under authenticated paths. Grey-box: testers get test accounts, some documentation, and an architecture overview. The fastest path to coverage for most web app engagements. White-box: testers get source code, design documents, and full access. The deepest tier, common before compliance audits or after a real incident.

When do I need a penetration test?

Four common triggers. Compliance: SOC 2, PCI-DSS, HIPAA, and most enterprise procurement processes require an annual pentest from a third party. Customer demand: an enterprise prospect asks to see your latest pentest report before they sign. Major changes: new authentication system, big refactor, acquisition. Suspicion: you believe something is wrong and want a real person to verify whether it is.

At QUANT LAB

We run pentests on web applications, APIs, networks, and Active Directory for founders who want a real engagement, not a clipboard-and-scan deliverable. Every engagement includes scoping, hands-on testing mapped to MITRE ATT&CK and OWASP Top 10, a written report you can hand to your auditor, a remediation debrief, and a retest after fixes ship. Read our founder's pentest buyer guide for deeper context.

What is included in a penetration test report?

A real report runs 30 to 80 pages. The structure is consistent across reputable firms: an executive summary leadership can read in five minutes, a methodology section describing scope and approach, a findings inventory with severity ratings (Critical/High/Medium/Low/Informational), a per-finding writeup that includes a description, proof of exploitability with screenshots, the attack narrative, affected components, and concrete remediation steps. The good ones also include a strategic recommendations section that addresses systemic issues — not just the bugs you found, but the development practices that allowed them to ship.

Long-form deep-dives that use this term

All posts

Related terms

Scoping a pentest?

Whether driven by SOC 2, a customer ask, or a real concern, we will scope it honestly and quote it transparently. Book a 30-minute call.

Penetration testing services