Choosing
Security review, scan or penetration test: which do you need?
'Get a pen test' has become the default advice after any breach in the news. Sometimes it's right. Often a business would get more from a review of its code and configuration first, and some only need an automated scan. They answer different questions, cost different amounts and suit different stages, and the right order saves money.
Rather just ask someone? Talk to usIn short
A vulnerability scan is automated and finds known issues. A security review reads your code and configuration to find the flaws scanners miss, such as broken access rules and exposed keys. A penetration test is a formal attempt to break in, often required by contracts. Most businesses benefit from a review first, and a certified pen test when required.
General information, current as at November 2026, not legal advice. A review lowers risk; it can't guarantee a system won't be breached, and it isn't a certified penetration test or a compliance audit.
- What is a penetration test?
- An authorised, simulated attack on a system by security specialists, usually within a fixed scope and time, ending in a formal report. In Australia, buyers and insurers often look for testers accredited by bodies such as CREST. A pen test shows what an attacker could achieve; it doesn't usually read every line of code.
What actually matters
A scan is cheap, fast and shallow
Automated scanners check for known vulnerabilities, missing patches and common misconfigurations. Run them continuously. They can't tell whether one user can read another's records, because they don't understand what your app is meant to do.
A review finds the flaws that need context
With the code and configuration in front of them, a reviewer can see missing permission checks, secrets in history, risky dependencies and over-permissioned integrations directly, often in less time than finding them from outside.
A pen test proves what an attacker could do
Testers chain weaknesses together the way a real attacker would, and the formal report carries weight with customers, insurers and auditors. When a contract, tender or certification asks for a penetration test, that's what you need.
Order matters
Paying a specialist tester to find an open database or a hard-coded key is expensive. Fix the obvious issues through a review first, and the pen test can spend its time on the harder questions, and comes back with a shorter report.
Ask what the deliverable is
Whoever you hire, ask for a sample report. Good ones explain each finding in plain language, show the evidence, rate the risk and say how to fix it. A long list of scanner output with no context isn't worth paying a premium for.
Side by side
Typical shapes. Scope and price vary widely with the size of the system.
| Criteria | Vulnerability scan | Security review | Penetration test |
|---|---|---|---|
| How it works | Automated tools | Expert reads code and config, tests the live system | Specialists simulate an attack |
| Best at finding | Known vulnerabilities, missing patches | Access control flaws, secrets, design and config issues | Exploitable chains of weaknesses |
| Needs code access | No | Yes | Usually not |
| Formal attestation | No | No | Often, from accredited testers |
| When it fits | Always, continuously | Before launch, after big changes, before due diligence | When a contract, insurer or tender requires one |
Where we'd point you elsewhere
We don't sell certified penetration tests. If you need one for a contract, a tender or a certification, engage an accredited tester. We're happy to prepare you for it, and to fix what it finds, but the attestation has to come from them.
Tell us what you'd like checked
Describe what you run and what's worrying you. We'll suggest a sensible scope and a fixed price, or tell you plainly if a different kind of specialist would serve you better.
Common questions
Usually not as a first step. Unless a customer, insurer or regulator requires one, a small business gets more from multi-factor login, patching and a review of any custom software it runs. A pen test makes sense once the basics are in place, or when someone asks for it.
It depends heavily on scope: the number of applications, user roles, APIs and environments. Small web application tests are commonly quoted in the thousands to low tens of thousands of dollars, and larger engagements more. Ask several accredited providers for a scoped quote.
Not quite. A code review checks quality and correctness, and may catch some security issues. A security review looks specifically for weaknesses attackers exploit, and covers configuration, cloud, integrations and secrets as well as code.
Only if the customer accepts it, and many won't when their questionnaire asks for a penetration test. Ask them what evidence they need. A review is often a good way to get ready for the test and to answer the rest of the questionnaire.
See it working
Software we'd build, running with a fictional business and sample data. Use it, then decide.
Also worth a look
- Code and Infrastructure Security Review
- Answering Customer Security Questionnaires
- Cloud and Hosting Security: What to Check
- Already broken or stuck? Fix & rescue
Last reviewed . General information, not legal advice. Figures cited are from the sources named on each page.