Automated scanner or penetration test?
What each one finds, what it misses, and which fits your website or online shop.
In brief
An automated vulnerability scanner finds known issues quickly and cheaply. A penetration test examines how far a thinking attacker can get in your application. Neither replaces the other.
What scanners do well
- Known vulnerabilities in outdated software and plugins.
- Faulty TLS settings and missing security headers.
- Exposed files and interfaces with well-known names.
- Regular, fast checks between tests.
What they rarely understand
- Permissions: can a customer see another customer's order by changing an ID? A scanner does not know who may access what.
- Business logic: can a coupon be redeemed twice, can price or quantity be changed in the request, can the payment step be skipped?
- Chained flaws: several minor issues together can lead to account takeover.
- The authenticated area: roles and workflows need a person to walk through them meaningfully.
Scanners also produce false positives, so results are hard to prioritize without human review. A clean result does not mean there are no flaws.
Which should you choose?
| Situation | Recommendation |
|---|---|
| Simple brochure site without login | Regular updates and scanning, a short review if needed |
| Online shop, customer accounts, personal data | Penetration test before launch and after major changes |
| Portal or SaaS with several customers | Penetration test, with particular attention to customer separation |
| A partner requests independent testing | Penetration test, with a report you can hand over |
An important rule
Scan or test someone else's system only with the owner's written permission, even with good intentions. To have your own site tested, read about our web penetration testing.