Vulnerability assessment and penetration testing (rules of engagement, testing knowledge levels)

Vulnerability assessment and penetration testing are related but different. A vulnerability assessment identifies, quantifies and prioritizes weaknesses, usually with automated scanners that compare systems against databases of known vulnerabilities identified by Common Vulnerabilities and Exposures (CVE) numbers and scored with the Common Vulnerability Scoring System (CVSS). It is broad, frequent and relatively safe. A penetration test goes further: skilled testers attempt to exploit weaknesses, chain them together and demonstrate real impact, such as reaching sensitive data. It is deeper, narrower, more expensive and carries more operational risk.