What vulnerability scanning can tell you.
A vulnerability scanner checks reachable systems against a collection of tests and known indicators. Depending on configuration and access, the output may highlight software versions, exposed services or settings that need investigation. Coverage depends on what the scanner can reach and what it is configured to inspect.
Treat the output as information to review. A detected issue may need confirmation, and a clean result does not establish that every workflow or access boundary is safe. Scanning can be useful as one input to ongoing security work, especially when someone is responsible for reviewing results and tracking fixes.
What a penetration test adds.
A penetration test investigates agreed systems and the potential impact of weaknesses within written boundaries. It may use automated tools alongside targeted examination. For example, an application assessment can explore whether different user roles can access information or actions outside their intended permissions.
The value comes from the evidence and interpretation relevant to the agreed environment. Testing should be planned around the business question, available access and operational constraints. Destructive activities or actions against third parties are not implied by permission to test your own application.
Questions to ask before choosing.
Use the proposal to establish what will actually happen. The name of the service alone is not enough to compare two engagements.
- Do we need broad identification of potential issues, or investigation of particular access boundaries and workflows?
- Which systems, roles and interfaces will the assessment cover?
- How will potential findings be checked and explained?
- What evidence, limitations and remediation guidance will the report contain?
- Who can act on the findings, and what follow-up will they need?
Consider a customer portal.
A portal may contain a public website, customer accounts, staff functions and APIs. A scan of the public hostname may reveal useful technical information while leaving important questions about authenticated workflows unanswered. An agreed application assessment can examine selected role and record-access scenarios using suitable accounts.
This is a planning example, not a finding about your portal. The appropriate coverage depends on its architecture and the access you can provide. A website assessment, application test and configuration review may complement one another when their boundaries are explicit.
Understand the limits of either assessment.
An assessment describes an agreed scope at a particular time. Changes to the system, unavailable access and excluded components affect what can be concluded. Ask for those limitations to be recorded so a report does not become a broader assurance statement than the work supports.
Start with your systems and concerns when contacting Blackcube Solutions. We can discuss the type of assessment that fits those questions, the authorisation required and how findings can support your next steps.
Further reading.
- NIST SP 800-115An overview of assessment techniques and their uses and limitations.
- OWASP Web Security Testing GuideFurther reading on web application security testing.
Discuss the right scope.
These services can support a conversation about your systems and assessment goals.