What is the difference between a vulnerability assessment and a penetration test?

A vulnerability assessment is broad and automated. A scanner enumerates systems and reports known vulnerabilities against a signature database, producing a prioritised list. It answers "what weaknesses might we have?" — cheap enough to run continuously, wide in coverage, and it produces false positives that need triage. It does not confirm anything is actually exploitable.

A penetration test is narrow and human-driven. A tester attempts to actually exploit weaknesses, chain them together, and demonstrate real impact. It answers "what could an attacker actually achieve?" — expensive, point-in-time, and far more valuable because it proves consequence rather than listing possibility.

The key difference: a scanner might report three medium-severity findings independently. A tester chains them into domain administrator access and shows you the customer database. The findings were the same; the understanding is completely different.

Types of penetration test: black box (no prior knowledge, simulating an external attacker), white box (full information and source access, most thorough per hour spent), and grey box (partial knowledge, often simulating a compromised user).

Note: Two further distinctions worth making. A red team engagement is broader still — testing detection and response, not just technical vulnerabilities, and usually without the defenders knowing. And scope and rules of engagement must be agreed in writing before any test; testing without written authorisation is a criminal offence regardless of intent.