I have found that there are several website owners and hosting companies that are either misinformed or a little confused about the differences between a vulnerability scan and a penetration test.

There are, nonetheless, a major difference between the two. To quote from the book Achieving PCI Compliance page 245,

“A vulnerability scan is a simple test that looks for and reports on any vulnerabilities found within your network infrastructure. That is the extent of a vulnerability scan: Identification and reporting. [The PCI Compliant Security Scan reports describe any vulnerabilities a website might have, and also delineates the solution]

A penetration test is often times conducted after the vulnerability scan. A penetration test attempts to exploit one or more of the vulnerabilities identified during the vulnerability scan. A penetration test attempts to verify if an identified vulnerability is actually susceptible to being exploited.”

Vulnerability scanning must be run against the internal and external networks on a quarterly basis, and after any significant changes in the network like installations, changes in network topology, firewall rule modifications, product upgrades, etc. If you run the vulnerability scan and there are no security issues, a penetration test is not necessary.

Trust Guard, the leader in website security, uses a PCI compliant Approved Scanning Vendor (ASV) and offers vulnerability scanning on a quarterly and daily basis. They also provide the PCI compliant scan reports and security verification seals to show online visitors that the website has been scanned. When online consumers see that our sites are safe from hackers, they feel confident and our conversion rates increase – sometimes significantly.

If you have any questions about Trust Guard’s Security scans and/or trust seals, please call toll free 877-848-2731 – Ask for Aaron.