Penetration Test vs. Vulnerability Scan vs. Security Review: What Does a Small Business Need?
When a client, insurer or partner asks whether your website has been “security tested”, you will quickly meet three terms that are often used interchangeably: vulnerability scan, security review (or audit) and penetration test. They are not the same thing, they cost very different amounts, and buying the wrong one means either paying for depth you do not need or getting a report that does not answer the question you were asked.
This guide explains each option in plain English, compares them side by side, and helps you decide what a small business actually needs.
The short version
- Vulnerability scan: an automated tool checks your site against a database of known issues. Fast and cheap, but shallow and noisy.
- External security review: a specialist examines everything your site exposes from the outside, verifies what matters, and gives you a ranked, explained report.
- Penetration test: testers actively try to break in, often with user accounts, to prove what an attacker could achieve.
Think of it like a building: a scan is a camera that notices open windows, a review is an inspector who walks around and tells you which windows matter and how to fix them, and a penetration test is a hired burglar who tries to get inside and shows you how.
What is a vulnerability scan?
A scanner crawls your website and compares what it finds — software versions, headers, known plugin vulnerabilities, common misconfigurations — against a list of known problems. Many hosting providers and security plugins include one.
Good for: continuous, cheap monitoring and catching obvious regressions between deeper checks.
Limitations: false positives you have to triage yourself, no understanding of context or business impact, and blindness to issues that need human reasoning, such as a staging site that should not be public or a form that leaks data.
What is an external security review?
An external security review, sometimes called a website security audit, combines tooling with manual analysis by a specialist who looks at your site the way an attacker would, without needing internal access. Typical scope includes TLS configuration, security headers, cookies, public forms and login pages, exposed files and admin panels, subdomains, information leakage and email authentication.
Good for: small and mid-sized business websites, lead-generation sites and modest online shops that want a professional baseline and a clear, prioritised to-do list.
Limitations: it confirms that weaknesses exist and explains their risk, but it does not attempt deep exploitation or test every function behind a login the way a full penetration test does.
What is a penetration test?
A penetration test (pentest) is a time-boxed, authorised simulated attack. Testers usually receive test accounts with different permission levels and try to bypass authentication, access other users’ data, escalate privileges, abuse business logic and chain small weaknesses into a real compromise. The report demonstrates impact with evidence.
Good for: custom web applications, customer portals, SaaS products, systems handling payments or sensitive data, and situations where a contract, regulator or framework explicitly requires a penetration test.
Limitations: it costs considerably more, takes longer to scope and run, and for a simple marketing website much of that depth has nothing to test.
Side-by-side comparison
- Who does the work: scan — software; review — specialist plus tools; pentest — specialist team plus tools.
- Depth: scan — known signatures; review — full external exposure, verified and prioritised; pentest — active exploitation, often including authenticated areas.
- Typical duration: scan — minutes to hours; review — about one to two weeks; pentest — one to several weeks, plus scoping.
- Typical cost for a small business: scan — free to a few hundred dollars per year; review — roughly $700 to $4,000; pentest — commonly $5,000 and up. More detail in how much a website security audit costs.
- Deliverable: scan — automated list; review — ranked plain-English report with fixes; pentest — detailed technical report with proof of exploitation.
- Risk to the live site: scan — low; review — very low, non-intrusive; pentest — managed, but needs agreed testing windows.
“Buy the test that answers your real question. ‘Are we exposed?’ and ‘Can someone break in and prove it?’ are different questions with different prices.”
NyorsoftExternal Security Review
Which one does your business need?
Choose a vulnerability scan if…
you want ongoing, low-cost monitoring alongside other measures. On its own, it is not an assessment.
Choose an external security review if…
- your website is mainly marketing, lead forms, bookings or a standard online shop;
- you have never had an independent security check and want a baseline;
- a client or insurer asks whether your website has been reviewed;
- you want a clear, prioritised list your developer can work through.
Choose a penetration test if…
- you run a custom application, customer portal or SaaS product;
- users log in and can see or change data that must stay private;
- a contract, regulator or standard explicitly requires a “penetration test”;
- you have already fixed the external basics and want to go deeper.
Many companies sensibly do both in sequence: an external review first to fix the visible, inexpensive issues, then a penetration test focused on the application itself, so the testers’ expensive time is not spent reporting missing headers.
Questions to ask any provider
- Which of the three is this, in your own words?
- What exactly is in scope, and what is excluded?
- How much is manual analysis versus automated output?
- Can I see a sample report?
- Is the price fixed? Are follow-up questions and a retest included?
- How do you make sure testing will not disrupt my live website?
How Nyorsoft can help
We specialise in external security reviews for small businesses, with fixed prices: the Public Website Security Check ($790), the deeper External Website Security Review ($1,900) and the Website & Data Exposure Assessment ($3,900). If your situation calls for a full penetration test, we will tell you so honestly. See our pricing or send us your website URL for a recommendation.
Frequently asked questions
What is the difference between a penetration test and a vulnerability scan?
A vulnerability scan is automated and lists potential known issues. A penetration test is performed by people who actively try to exploit weaknesses to show what an attacker could really achieve, including in logged-in areas.
Is a security review the same as a security audit?
The terms are often used interchangeably for a manual assessment of a website’s security posture. What matters is the scope and depth described in the proposal, not the label.
Does a small business need a penetration test?
Not usually for a brochure site or standard online shop; an external security review gives a better return. A penetration test makes sense for custom applications, customer portals, SaaS products, or when a contract or regulator requires one.
How much does a penetration test cost compared to a security review?
For a small business website an external security review typically costs roughly $700 to $4,000, while penetration tests commonly start around $5,000 and rise with application size and complexity.
Can a security review or penetration test break my website?
An external review is non-intrusive. Penetration tests involve active attempts, so reputable testers agree scope, timing and safeguards in advance to avoid disruption.
Sources and further reading
- NIST SP 800-115: Technical Guide to Information Security Testing and Assessment – how reviews, scans and penetration tests differ and how they are planned.
- OWASP Web Security Testing Guide – the reference methodology for testing web applications.
- OWASP Top 10 – the most critical web application security risks.
Not sure what your website exposes?
Our Public Website Security Check looks at your site the way an attacker does — TLS, security headers, email authentication and exposed services — and gives you a short, ranked list of what to fix.
Pavol brings IT analysis experience from banking and financial-sector projects to Nyorsoft’s external security reviews for small businesses. About our team