Scanning vs Pentesting: What Auditors Accept
Quick Answer
Auditors generally accept vulnerability scanning as evidence of routine detection controls, but only penetration testing satisfies requirements for validated, exploit based assurance. ISO 27001, SOC 2, PCI DSS, and the ACSC Essential Eight each expect scanning on a continuous or quarterly cadence, with penetration testing performed at least annually or after significant system changes. Relying on scanning alone is one of the most common gaps auditors raise against Australian organisations during certification and attestation reviews.
Vulnerability scanning vs penetration testing is a question that comes up in almost every audit preparation conversation, and the confusion is understandable. Both activities look for weaknesses in your systems, both produce reports auditors will ask to see, and both get lumped together under the umbrella of “security testing.” But auditors do not treat them as interchangeable, and submitting the wrong one, or only one, at the wrong stage of an audit is a fast way to draw a finding.
Having run scanning and penetration testing engagements across ISO 27001, SOC 2, PCI DSS, and Essential Eight audits, CyberSapiens sees the same pattern repeatedly: organisations that treat these as one combined checkbox usually have a scanning tool running, no recent penetration test, and a control gap they only discover when an auditor asks for evidence. This guide sets out exactly what each activity finds, what auditors expect from each framework, and how to run both on a cadence that satisfies compliance requirements without blowing out your security budget.
Vulnerability Scanning vs Penetration Testing: The Verdict
Neither activity replaces the other. Vulnerability scanning gives auditors evidence of continuous, automated detection. Penetration testing gives auditors evidence that a human has actually tried to exploit a weakness and confirmed the real world impact. Every major framework operating in Australia expects both, on different schedules, for different reasons.
| Factor | Vulnerability Scanning | Penetration Testing |
|---|---|---|
| Method | Automated, tool driven | Manual, human led with tool support |
| What it proves to an auditor | You are continuously watching for known weaknesses | Your controls hold up against a real attempted breach |
| Typical cadence expected | Continuous to quarterly | Annually, or after major system changes |
| Cost per cycle | Low | Higher, scoped per engagement |
| Accepted alone as full audit evidence | No, for any major framework | No, most frameworks still expect scanning between tests |
In our audit preparation engagements, the organisations that pass without findings are the ones running both in parallel, not choosing one over the other. Scanning catches the drift between penetration tests. Penetration testing catches what scanning tools structurally cannot see, such as chained exploits and business logic flaws.
What Vulnerability Scanning Finds, and What It Misses
The two activities are not scaled versions of the same test. They look for fundamentally different classes of weakness, which is exactly why auditors expect both rather than treating one as a substitute for the other.
Known, Catalogued Weaknesses
Missing patches, outdated software versions, exposed ports, weak TLS configurations, and default credentials that match entries in public vulnerability databases such as the CVE list.
Chained and Logic-Based Attacks
Business logic flaws, privilege escalation paths that combine several low severity issues, and anything requiring human judgement to recognise as exploitable in context.
Real-World Exploitability
Whether a discovered weakness can actually be chained into meaningful access, how far an attacker could move laterally, and whether compensating controls hold up under active attempt.
Continuous Drift
A point-in-time test cannot catch a new critical patch released the week after the engagement ends, which is exactly the gap ongoing scanning is designed to cover.
In one CyberSapiens network engagement covering more than 40 assets, scanning surfaced misconfigurations against OWASP, PTES, NIST, and CIS benchmarks, but it was the manual testing phase that confirmed which of those misconfigurations, such as anonymous SMB access and RPC null authentication, could actually be chained into unauthorised lateral movement. That distinction, automated finding versus confirmed exploit path, is precisely what auditors are trained to look for when they review evidence.
Framework Acceptance: ISO 27001, SOC 2, Essential Eight, and PCI DSS
Each framework sets its own expectations for how often scanning and penetration testing should occur, and mixing them up is one of the most common preparation mistakes we see across Australian audits. The matrix below sets out the minimum cadence auditors typically expect for each.
| Framework | Scanning Cadence | Pentest Cadence |
|---|---|---|
| ISO 27001 | Continuous to quarterly | Annually, or after major change |
| SOC 2 | Continuous monitoring | Annually (common auditor expectation) |
| ACSC Essential Eight | Continuous, tied to patch maturity level | Not mandated, often requested by agencies |
| PCI DSS | Quarterly via Approved Scanning Vendor | Annually and after significant change |
According to the PCI Security Standards Council, PCI DSS Requirement 11 explicitly separates quarterly ASV scanning from annual penetration testing, treating them as two distinct pieces of evidence rather than one combined activity. This same pattern repeats across every framework in the table above. Cadence shown is a minimum expectation, and organisations in higher-risk sectors such as finance or healthcare should test more frequently than these floors suggest.
A Cost-Effective Combined Cadence
Running both activities does not mean doubling your security budget. The most cost-effective programs we build for Australian clients layer continuous scanning underneath scheduled penetration tests, so the expensive manual work only happens when it adds evidence scanning cannot provide on its own.
Run Continuous or Weekly Scanning on Internet-Facing Assets
Automated scanning is cheap at scale. Point it first at anything internet-facing, since these are the assets every framework, and every real attacker, checks most often.
Extend Scanning to Internal Assets Fortnightly to Monthly
Workstations and non-internet-facing servers carry lower immediate risk, so most frameworks accept a lighter touch here, freeing budget for the assets that matter most.
Patch Critical Findings Within 48 Hours
According to the Australian Cyber Security Centre, vulnerabilities assessed as critical should be patched, updated, or otherwise mitigated within 48 hours. Building this into your scanning workflow removes the single most common finding auditors raise.
Schedule One Annual Penetration Test, Timed to Your Audit Window
Book the test six to eight weeks before your audit or renewal date. This gives enough runway to remediate findings and retest before an auditor asks to see the report.
Trigger an Extra Pentest Only After Major Change
A new production system, major architecture change, or significant infrastructure migration should trigger an additional test outside the annual cycle. Everything short of that can wait for the scheduled engagement.
We have built this cadence into engagements ranging from a five-day network VAPT for a cloud service provider to a 40-plus asset assessment for a data intelligence firm, and in both cases the combination, not either activity alone, is what closed out the audit findings without unnecessary retesting costs.
Content Reviewed By
Ketki Tidke
Cyber Security and GRC Lead Auditor — ISO 27001 Lead Auditor
Ketki is a certified ISO 27001 Lead Auditor specialised in Governance, Risk and Compliance, with experience consulting public, private, and government clients. She evaluates threats, risk impacts, and regulatory requirements across multiple industry frameworks.
Frequently Asked Questions
What is the difference between vulnerability scanning and penetration testing?
Vulnerability scanning is an automated process that identifies known weaknesses against a database of published vulnerabilities. Penetration testing is a manual, human-led process that attempts to exploit those weaknesses to confirm real-world impact, which is why the two are treated as separate audit evidence rather than interchangeable tests.
Do auditors accept vulnerability scanning alone for compliance?
No, scanning alone is not accepted as complete evidence under ISO 27001, SOC 2, PCI DSS, or Essential Eight. Auditors expect scanning to demonstrate continuous detection and a separate penetration test to demonstrate that critical findings cannot actually be exploited, so a documented combination of our VAPT services is the standard evidence package auditors look for.
How often should we run vulnerability scans for ISO 27001 or SOC 2?
Most organisations scan internet-facing assets continuously to weekly and internal assets fortnightly to monthly, which satisfies both ISO 27001’s technical vulnerability management control and SOC 2’s continuous monitoring criteria. Your governance, risk, and compliance program should document the specific cadence you commit to, since auditors will check that practice matches policy.
Is penetration testing required for Essential Eight compliance?
The Essential Eight itself does not explicitly mandate penetration testing, focusing instead on patching timeframes and application control. In practice, Australian government agencies and enterprise clients frequently request a recent penetration test as supplementary evidence before accepting an Essential Eight maturity self-assessment.
How much does combining scanning and penetration testing cost?
Continuous or scheduled scanning is a relatively low, predictable cost since it is automated, while an annual penetration test is priced per engagement based on scope and asset count. Layering scanning underneath one well-timed annual test, rather than running multiple ad hoc tests through the year, is the combination that keeps total spend lowest while still satisfying audit requirements.
Plan Your Cadence
Whether you need continuous scanning, an annual penetration test, or both mapped against ISO 27001, SOC 2, PCI DSS, or Essential Eight, our team can build a schedule that satisfies your auditors without overspending. Book a free consultation and we will show you exactly where your current program has gaps.
Plan Your Cadence