Guide

Security assessment, penetration test, or vulnerability scan?

An assessment checks whether controls are configured and working. A vulnerability scan lists known weaknesses. A penetration test tries to exploit them. For most SMEs, the audit is the right first step.

Last updated 3 November 2026

	Security assessment	Vulnerability scan	Penetration test
Question it answers	Are the controls in place and configured?	What known weaknesses show up on a scan?	Can someone exploit a path in?
What changes	Nothing. The assessment is read-only.	Usually nothing, beyond the scan traffic.	Only what the agreed scope allows the tester to attempt.
What you receive	Coverage report, board summary, ranked fix plan, review call.	A list of findings, often ranked by severity.	A narrative of attack paths and evidence.
Who usually buys it first	An MSP, for an SME that wants a clear baseline.	Teams that already patch and want a recurring list.	Teams with a defined scope and someone to receive the exploit evidence.
Where it sits	The first paid review, then remediation.	Often a recurring hygiene check.	A separate scope, after the obvious gaps are closed.

MSP Security Audit is a security assessment, not a penetration test. If your client needs one, it can be arranged separately. See the six assessments.