Security Audit vs Pentest vs Vulnerability Scan: Which One?

A 30-person logistics company in Dorval gets three requests in the same week. Its insurer wants a "security assessment." Its biggest customer requires a "pentest." And its managed IT provider is pitching a "monthly scan." Three terms, three services, three very different invoices.

The confusion is understandable. Vendors themselves use these words interchangeably. But picking the wrong one means either overpaying to answer a simple question or buying a false sense of security.

A home analogy helps. A vulnerability scan is the smoke detector. A penetration test is a locksmith you hire to try to break in. An audit is the full pre-purchase inspection, including the question of who still has a spare key.

The vulnerability scan: your automated smoke detector

A scanner is software that probes your systems and compares what it finds against a database of known flaws: outdated software versions, unnecessary open ports, expired certificates. It can run from the outside (what the internet sees) or the inside, with or without credentials.

Strengths: fast, inexpensive per run and ideal for ongoing monitoring. It's the perfect way to confirm that your patch management policy is actually being followed.

Limits: it only finds what it already knows about. It produces false positives that someone has to triage, and it has no understanding of your applications' logic. A scanner will never notice that a customer can open another customer's invoice by changing a number in the address bar.

It's also worth asking which kind of scan you're being offered. An unauthenticated external scan only sees the front door. An authenticated scan, run with an account on your workstations and servers, sees far more: unpatched software, weak configurations, forgotten local accounts. Both are useful, but they answer different questions.

The penetration test: a simulated attack

In a penetration test, specialists think and act like an attacker. They use tools, including scanners, but mostly they rely on judgment: chaining three minor flaws into one major breach, guessing a password from the company's name or bypassing a payment step.

The deliverable isn't a list of potential issues. It's evidence of what can actually be exploited. A penetration test always requires written authorization from the system owner; without it, the activity can constitute unauthorized use of a computer under section 342.1 of the Criminal Code.

Canadian vendors publish very wide ranges, from a few thousand to several tens of thousands of dollars depending on scope (for example, Packetlabs, August 2026). We break down what moves that number in our article on penetration testing cost.

The security audit: the big picture

An audit asks a broader question: is your organization reasonably protected, given its risks? It reviews configurations, but also processes (what happens when an employee leaves?) and people (who can recognize a phishing email?).

It relies on a framework, such as the Canadian Centre for Cyber Security's baseline controls, and produces a prioritized action plan. For a business that has never been assessed, it's usually the best first step. Our guide to the cybersecurity audit for small businesses walks through each stage.

Side-by-side comparison

NIST, the U.S. standards body, draws the same distinctions between these techniques in its SP 800-115 guide to security testing and assessment.

Which one do you need? Three typical situations

A 12-person law office in Notre-Dame-de-Grâce that has never been assessed. Start with an audit. A pentest would probably confirm basic gaps, such as missing multi-factor authentication, that an audit would have found for less, while also covering backups and Law 25.

A software company in Ottawa whose enterprise customer requires a pentest. Here, an application penetration test is non-negotiable: it's the evidence the customer asked for. Add regular scans between tests to keep track of new flaws in the components you use.

A wholesale distributor in Laval that was audited last year and has finished its action plan. This is the ideal time for a penetration test, which will confirm the fixes hold up against a real attack. Monthly scans by the IT provider round things out.

Some standards set their own requirements. Merchants subject to PCI DSS, the payment card standard, must carry out periodic vulnerability scans and penetration tests, among other obligations.

Look past the label: six questions to ask

Whatever name appears on the quote, these questions tell you what you're really buying:

• Is the deliverable a raw list of findings, or evidence of exploitation?
• How many days of manual work are planned, and by whom?
• Are processes and people assessed, or only technology?
• Are false positives triaged before the report is delivered?
• Is the framework or methodology named?
• Is a follow-up check included after you fix things?

If the answer to the first question is "a raw list" and there's no manual work, you're buying a scan, whatever the service is called. That's fine, as long as the price reflects it.

The sensible order for a small business

For most small and mid-sized businesses, this sequence delivers the best return:

1. Audit to understand where you stand and what to fix first.
2. Fixes for the priority gaps: multi-factor authentication, patching, offline backups, dormant accounts.
3. Regular scans to make sure those fixes stick over time.
4. Penetration test to validate everything through an attacker's eyes.

The most common mistake? Ordering an expensive pentest before the basics are in place, and paying specialists to tell you what a checklist would have revealed. The opposite happens too: relying on automated scans for years and assuming everything is fine because the dashboard is green.

If the request comes from an insurer, our article on the cyber insurance questionnaire will help you prepare the answers they expect.

Still unsure? Our team can start with a cybersecurity audit and tell you at the end whether a penetration test is justified in your case.