Executive guide · Web security
Automated scanner or penetration test?
What each one finds, what it misses, and which fits your website or online shop.
4 November 2026 · P1R4T3 Research
In brief
An automated vulnerability scanner finds known issues quickly and cheaply. A penetration test examines how far a thinking attacker can get in your application. Neither replaces the other.
What scanners do well
- Known vulnerabilities in outdated software and plugins.
- Faulty TLS settings and missing security headers.
- Exposed files and interfaces with well-known names.
- Regular, fast checks between tests.
What they rarely understand
- Permissions: can a customer see another customer's order by changing an ID? A scanner does not know who may access what.
- Business logic: can a coupon be redeemed twice, can price or quantity be changed in the request, can the payment step be skipped?
- Chained flaws: several minor issues together can lead to account takeover.
- The authenticated area: roles and workflows need a person to walk through them meaningfully.
Scanners also produce false positives, so results are hard to prioritize without human review. A clean result does not mean there are no flaws.
Which should you choose?
| Situation | Recommendation |
|---|---|
| Simple brochure site without login | Regular updates and scanning, a short review if needed |
| Online shop, customer accounts, personal data | Penetration test before launch and after major changes |
| Portal or SaaS with several customers | Penetration test, with particular attention to customer separation |
| A partner requests independent testing | Penetration test, with a report you can hand over |
An important rule
Scan or test someone else's system only with the owner's written permission, even with good intentions. To have your own site tested, read about our web penetration testing.