Guide

Security audit, penetration test, or vulnerability scan?

An audit checks whether controls are configured and working. A vulnerability scan lists known weaknesses. A penetration test tries to exploit them. For most SMEs, the audit is the right first step.

Last updated 21 October 2026

	Security audit	Vulnerability scan	Penetration test
Question it answers	Are the controls in place and configured?	What known weaknesses show up on a scan?	Can someone exploit a path in?
What changes	Nothing. The audit is read-only.	Usually nothing, beyond the scan traffic.	Only what the agreed scope allows the tester to attempt.
What you receive	Scored report, executive summary, fix list, review call.	A list of findings, often ranked by severity.	A narrative of attack paths and evidence.
Who usually buys it first	An MSP, for an SME that wants a clear baseline.	Teams that already patch and want a recurring list.	Teams with a defined scope and someone to receive the exploit evidence.
Where it sits	The first paid review, then remediation.	Often a recurring hygiene check.	A separate scope, after the obvious gaps are closed.

MSP Security Audit is the configuration and controls audit. Penetration testing can be scoped separately. It is not included in the baseline fee. See baseline and compliance pricing.