We're being offered automated vulnerability assessments — can that replace a penetration test, or is it something totally different?

Scanners just check HTTP status codes and known CVE signatures. No automated tool will catch business logic bugs, like someone changing a cart total to a negative value on your B2B portal and checking out. That's why manual testing is non-negotiable.

Read the client's requirements word for word. Does it say "penetration testing" or "vulnerability assessment"? If it's an enterprise client, you hand them an automated scan report and they'll slide the contract right back across the table asking for a pentest, and your 1,400 EUR goes down the drain.

Before deciding, follow these steps: 1) Ask the client's compliance team for an example report format they accept. 2) Have your internal team run OS and library updates on your servers. 3) Spend the remaining budget on a targeted manual test focused solely on your critical API endpoints.

We made the exact same mistake with a client in Madrid last year. Paid 1,100 EUR and submitted an automated scan report. Two days later their audit team rejected it, saying "this is just tool output, there's no proof of exploitability." We had no choice but to shell out another 3,000 EUR for a manual test.

What that agency is charging 1,400 EUR for is probably just typing your domain into commercial scanning software and hitting "start." They'll hand you a 40-page PDF with colorful charts. Before spending that kind of money, you can run a similar scan yourself using open-source tools.

Do you process payments or store sensitive personal data on your portal? Also, what specific compliance standard is your client subject to? Some public tenders in Spain explicitly require an accredited pentest report under ENS regulations.

Dont sweat it, people confuse the two all the time. An automated scan is like a blood test; it gives you a general overview. A penetration test is the surgeon going in to find the actual problem. like if you need to convince your client you need the surgeon.

imo just ask the client straight up whether they expect a pen test report or if a vulnerability scan is enough and anyway no point blowing 3500 euros upfront if all they want is a scan just to tick a box.

Following.

Timely topic.

I agree, and I'd like to emphasize that. Start with a small trial; don't commit to everything at once.

Start with a small trial; don't commit to everything at once. If you have questions, write them; I'll answer as best I can.

Saved.

You're right.

I'm in the same situation that's why I'm asking. Most time waste accumulates in tasks waiting for approval.

Just leaving this note, it might be useful.

Sorry but this doesn't apply in every case. Start with a small trial; don't commit to everything at once.

If 2FA is on, a stolen password alone is useless.

Exactly, and not many people know this. Solutions that work at a small scale collapse when you grow; I learned this late.

Correct me if I'm wrong.

I agree.

Correct.