What is the difference between a penetration test and a vulnerability assessment?
A vulnerability assessment looks for weaknesses and lists them. A penetration test goes further: testers act like real attackers and try to break in, with your written permission. The first tells you what is open. The second shows how far someone could get through it.
Last read from the sources at the foot of this page.
What does each one mean for a business?
NIST defines a penetration test as testers copying real attacks.
Security testing in which evaluators mimic real-world attacks in an attempt to identify ways to circumvent the security features of an application, system, or network.
What is a vulnerability assessment?
A vulnerability assessment is a review, not an attack. It finds and describes the weak points so you can fix them in order.
Systematic examination of a system or product or supply chain element to determine the adequacy of security measures, identify security deficiencies
Which one should a small firm do first?
- Start with what anyone on the internet can already see: your email records, the services that answer from outside and any look-alike domains.
- Close what that finds.A test against settings you already know are open mostly repeats the list.
- Book a penetration test when the basics are closed, or when a client or insurer asks for one by name.
- Agree the scope in writing before any test.A penetration test without permission is an attack.
Where is the change made?
Your DNS settings, for the email records. Your firewall or web host, for services that answer from the internet. Each finding in either kind of report should say which.
What else do people ask about this?
Does LeakTrace run penetration tests?
No. LeakTrace reads what anyone can see from outside, using public records only. It tests nothing and does not try to get in.
Do cyber insurers ask for a penetration test?
Some application forms ask whether you have had one, or a security assessment, in the past year. Our insurance questions page explains how to answer.
Where does this come from?
- NIST Computer Security Resource Center, Glossary: penetration testingcsrc.nist.govRead 16 October 2026
- NIST Computer Security Resource Center, Glossary: vulnerability assessmentcsrc.nist.govRead 16 October 2026
See what is open before anyone else does.
We read your domain from outside and show each way in with a check anyone can re-run.