Pen test, vulnerability scan or Cyber Essentials Plus: which one?

omebody has asked you for "a pen test". It might be the cyber insurance renewal form, a client's supplier questionnaire, a tender, or a director who read something. The problem is that the person asking often doesn't know what they mean, and three quite different things get called the same name. Buy the wrong one and you've either overspent or you've got a certificate that doesn't answer the question.

I've been through this a few times. Our cyber insurer required annual penetration testing, so I've commissioned several, and the thing I learned is that two pieces of work both called "pen test" can be nothing like each other. More on that further down.

Short version

• A vulnerability scan is automated. It finds known weaknesses (missing patches, open ports, weak configs) and gives you a list. Cheap, repeatable, no human judgement.
• A penetration test is a person trying to break in. They use scans to start, then exploit what they find and chain it together. The report tells you what an attacker could actually do.
• Cyber Essentials Plus is an audit against the five Cyber Essentials controls. It includes a vulnerability scan of sample devices and some hands-on checks, but it is not a pen test and nobody should accept it as one.
• Insurers usually mean "pen test" literally. Tenders and clients often mean "show us you're certified", which is Cyber Essentials, ISO 27001 or similar. Ask before you buy.
• The report is worth nothing until the findings are fixed. That's the bit most organisations get wrong.

What's a vulnerability scan?

A tool. It runs against your external IP addresses, your internal network, or both, and compares what it sees against a database of known vulnerabilities. Out comes a report listing missing patches, exposed services, expired certificates, default credentials and so on, each with a severity rating.

It's useful precisely because it's cheap and repeatable. Monthly or continuous scanning is how you keep on top of the 14-day patching window in Cyber Essentials, and it's what most managed security providers are actually running when they say they "monitor your vulnerabilities". What it doesn't do is think. It won't notice that two medium findings together give someone domain admin, and it will flag things that don't matter in your environment.

What's a penetration test?

A person, with a scope and a time budget, trying to get somewhere they shouldn't. They'll use scanning tools to get started, but the value is in what happens next: exploiting what they find, moving between systems, and showing you how far they got. A decent report tells you not just "port 445 is open" but "from a standard user laptop I got to the finance file share in forty minutes, here's how, here's what to fix first".

Scope matters. External testing looks at what's reachable from the internet. Internal testing assumes an attacker is already on the network (a compromised laptop, a malicious insider). Web application testing goes after a specific system, which is what a client will usually want if you're hosting something for them. Wireless, physical and social engineering tests exist too. "A pen test" with no scope attached is a sign the person asking hasn't thought about it, and the first job is to find out what they're worried about.

Red teaming is the next step up: a longer, stealthier engagement that tests whether your defences and your people notice an attack in progress. Most organisations under a few hundred staff don't need one and shouldn't be sold one.

What's Cyber Essentials Plus, and why doesn't it count?

Cyber Essentials Plus is the audited version of Cyber Essentials. An assessor checks that the five controls you claimed in the self-assessment are actually in place: they scan a sample of your devices for missing patches, test that your email and browser block malicious files, check MFA and account configurations. It's a useful thing to have and it's increasingly a condition of public sector and supply chain work.

But it's an audit against a baseline, not an attempt to break in. The scan is a vulnerability scan, not an exploit. If an insurer or client has asked for a pen test and you offer them your CE+ certificate, a well-informed one will say no, and a badly-informed one will say yes and you'll both be wrong. The reverse is also true: a pen test report doesn't get you Cyber Essentials.

If you're renewing Cyber Essentials this year, the 2026 changes are covered in a separate guide.

Who asks for which?

Insurers, in my experience, mean it literally. Our policy required annual penetration testing and that's what we had to evidence. Read the wording though, because some policies say "vulnerability assessment" and will accept a scan, and the difference in cost is significant.

Tenders and client questionnaires are messier. "Do you conduct regular penetration testing?" sits next to "Are you Cyber Essentials certified?" and "Do you hold ISO 27001?" and the person who wrote the questionnaire often doesn't know the difference either. If you're hosting a system for the client, they probably want a test of that system. If you're just handling their data, a certification usually satisfies them. When it's unclear, ask the procurement contact what the requirement is actually for. You'll usually get a sensible answer and sometimes a shorter list.

Regulators and professional bodies vary by sector. If yours has specific requirements, they'll be written down somewhere, and that's the document to work from rather than the questionnaire.

Not all pen tests are the same

This is the bit I'd want someone to have told me. I've had a tester come on site, and I've had a device posted to us to plug into the network with everything else done remotely. Both were sold as a penetration test. They were not the same product.

The person on site was clearly an expert. He answered questions as they came up, explained what he was seeing and why it mattered, and the test was detailed in a way that showed up in the report. The remote one felt largely automated, with a human writing up the output at the end. It wasn't worthless, but it was closer to a vulnerability scan with a nicer cover, and it cost more than one.

What to ask before you buy: who is actually doing the testing and what are their qualifications (CREST registration is the usual UK benchmark, CHECK if you're public sector). Can you see a sample report with the company name removed. Does the report show exploitation, or just findings. Is a retest included after you've fixed things. And will the tester talk to you during and after, because the conversation is often where the real value is.

The report isn't the point

The risk isn't failing the pen test. The risk is passing it, filing the report, and sitting on the findings. A report that says "critical: domain admin reachable from the guest network" and gets no follow-up for eight months is worse than no report, because now there's a document proving you knew.

Treat the findings like any other project. Put them in a tracker, assign an owner to each, agree a timeline that reflects the severity, and get the retest done to prove they're closed. Then keep the before-and-after as your evidence for next year's insurance form, which will ask what you did about last year's findings.

If you're being asked for one now

Find out what the person asking actually needs and what they'll accept. If it's an insurer, read the policy wording. If it's a client, ask what system or data they're worried about. Then scope the test to that, pick a tester on the strength of who's doing the work rather than the brochure, and book the follow-up before the test starts, not after the report lands.