A vulnerability scan tells you what is theoretically exposed. A penetration test tells you what someone could actually do with it, which is a different and much shorter list.

What gets tested, and what does not

Scope is agreed in writing before anything starts: which ranges, which applications, which techniques are in bounds and which are not. Production systems are tested inside a window you choose. Nothing is touched that was not on the list you signed.

How findings are ranked

By what an attacker could reach, not by the number a scanner printed. A medium-severity flaw that chains into domain admin is reported above a high-severity one that goes nowhere. Every finding comes with the steps to reproduce it.

The retest is the point

A report nobody acts on is an expensive PDF. We retest remediated findings, and the second report is the one you hand to your insurer or your auditor.

Common questions

How often should we test?

Annually for most businesses, and after any significant change to your network or a customer-facing application. Cyber insurance increasingly asks for evidence of both.

Will it break anything?

Denial of service techniques are excluded by default. Anything with a plausible availability risk is agreed with you first and run in an agreed window.