Penetration Testing vs Vulnerability Scanning: 900 Findings, and the Twelve That Open a Door

01 What each one actually buys

NCSC is just as blunt about scanning. Scanners "typically perform hundreds or even thousands of checks at a significantly faster pace than would be possible with manual testing", and that speed is real value. Then comes the limit: "automated vulnerability scanning cannot compare to manual processes such as penetration testing when it comes to the breadth and depth of test coverage". Scanners "typically aim for breadth instead of depth", and they lack "the ability to navigate web applications or detect vulnerabilities that require complicated interactions with specialised protocols" [ NCSC vulnerability scanning ] .

Read that as a division of labour. Let the scanner clear the routine ground. The NCSC says as much: addressing routine issues by scanning lets "penetration testing engagements ... more efficiently focus on complicated security issues that are better suited to a human". UK buying patterns run the other way round. Among British businesses, 32% used specific tools designed for security monitoring, 18% carried out a cyber security vulnerability audit, and only 13% carried out penetration testing in the last 12 months [ DSIT 2025/2026 ] , which puts the list well ahead of the proof in most UK security budgets.

02 The chain no scanner reported

Here is the scenario that decides the argument. It is a composite drawn from the way Windows estates fail, not a single named client. Five of the seven steps use a technique named in the joint Active Directory guidance that NCSC-UK co-sealed with ASD, CISA, NSA and partners, a document built around "the 17 most common techniques used by adversaries and malicious actors to compromise Active Directory" [ Joint AD guidance ] . Steps one and three sit outside that list. They are ordinary operator tradecraft that no catalogue needs to name. Not one step carries a CVSS score above 5.3. The chain ends at domain admin.

Four of the seven steps produce no CVE and no scanner finding at all, because none of them is a missing patch. The seventh step is simply what the first six buy. What the scanner misses here is configuration, permission and protocol decisions. The joint guidance explains why Active Directory keeps producing these paths: "permissive default settings, complex relationships and permissions, legacy protocol support, and limited tools for diagnosing security issues". It also states plainly that recovering from a compromise of it is "time-consuming, costly, and disruptive" [ Joint AD guidance ] .

An internal penetration test is where this chain gets discovered, because steps three onwards require a foothold on the network. Step one and step two belong to external penetration testing, which is why splitting the two into separate years leaves the join untested, and the join is where the attack lives.

03 The NCSC tells you to overrule the score

British security teams work a backlog sorted by CVSS base score, top down, and the national technical authority tells them not to. NCSC vulnerability management guidance states that while software or a vendor advisory "may provide a severity rating for the finding (such as the Common Vulnerability Scoring System or CVSS), it's essential that you consider business impact and risk for your organisation". Its triage model has three buckets, Fix, Acknowledge and Investigate, and it tells you to prioritise vulnerabilities "in services or applications that are internet facing" [ NCSC vulnerability management ] . Internet-facing first. Business impact second. Score third.

Run your own estate through those three buckets and the ordering changes immediately. A 9.8 on a decommissioned test box goes to Acknowledge. A 6.1 on the payroll server goes to Fix this week. A 5.3 username enumeration flaw on the VPN portal goes to Investigate, and that is the bucket where the chain from chapter two starts. The score told you none of this. Your knowledge of what the box does told you all of it.

FIRST agrees with the NCSC about its own number. The CVSS v4.0 specification defines the output as "numerical scores indicating the severity of a vulnerability relative to other vulnerabilities", then states that consumers "may use CVSS information as input to an organizational vulnerability management process that also considers factors that are not part of CVSS" [ FIRST CVSS v4.0 ] . An input. FIRST also marks the Threat and Environmental metrics optional and recommends them "for more meaningful results". Almost nobody fills them in. The base score your backlog is sorted by is the thinnest version of the number its own authors publish.

Skip the triage and the queue simply outgrows you. The median organisation in the 2026 Verizon dataset had 50% more critical vulnerabilities to remediate than it did the year before [ Verizon 2026 DBIR ] . A backlog that grows by half while your patching window stays the same is not a resourcing problem you can hire your way out of. It is a sorting problem. Decide what goes to the front, and let the rest sit in Acknowledge with a date and a name against it.

04 Cyber Essentials draws the line at 7.0

UK certification puts a hard number on this, and the number creates a blind spot worth understanding before your next assessment. Cyber Essentials Requirements v3.3, the "Danzell" question set published on 13 February 2026 and effective from 26 April 2026, makes questions A6.4 and A6.5 auto-fail. They ask whether "all high-risk or critical security updates and vulnerability fixes" for operating systems, router and firewall firmware and applications "are installed within 14 days of release" [ IASME Cyber Essentials v3.3 ] . The Requirements document sets the bar three ways. Critical or high risk vulnerabilities "are those with a CVSS v3 base score of 7 or above, or are identified by the vendor as 'critical or high risk'", and the same 14-day clock also runs when the vendor gives no severity details at all [ CE Requirements v3.3 ] .

Now put the chain from chapter two against those three tests. Its highest-rated individual finding scores 5.3. Four of the seven steps carry no CVE, so no score exists to compare. No vendor has flagged any of them as critical or high risk, because no vendor owns a permission model you configured yourself. None of the three tests fires, so the 14-day clock never starts. An organisation can hold a valid certificate, pass the Cyber Essentials Plus technical audit with its authenticated scan, and still hand an operator domain admin in under a day. That is not a criticism of the scheme. Cyber Essentials raises a floor, and it does that well. Floors are not ceilings.

Set that floor against how few UK organisations stand on it. 43% of businesses and 28% of charities identified a cyber security breach or attack in the last 12 months, roughly 612,000 UK businesses, rising to 65% of medium and 69% of large firms. Cyber Essentials awareness sits at 17% of businesses, and the proportion actually holding the certification reached 5%, up from 3% [ DSIT 2025/2026 ] . Only 25% of businesses have a formal incident response plan, though that rises to 57% of medium and 76% of large firms.

05 Run both, and split the work properly

A working programme uses scanning for coverage and testing for proof. The split below is what we see hold up in UK estates, from a 60-person firm to a listed group.

Give the scanner the routine ground

• Run it continuously on anything internet-facing, and weekly across the internal estate. Authenticated scans, or you are grading the wallpaper.
• Triage every finding into Fix, Acknowledge or Investigate, the way NCSC guidance sets out. A finding with no decision attached is not managed.
• Enrich before you rank. Tag KEV entries and EPSS probabilities onto every row, then apply your own asset criticality. Exploitability and blast radius decide the order, in that sequence.
• Track the 14-day clock on anything CVSS 7.0 and above, because that clock is an auto-fail on your certification and a genuinely good habit.

Give the operator the questions a tool cannot answer

• Chaining. Can several medium findings be joined into one path to your crown jewels? This is the finding that changes budgets.
• Business logic. Can a customer read another customer's invoice by changing a number? No signature exists for that.
• Active Directory paths. Kerberoasting, delegation, certificate services, credentials in Group Policy. Configuration, not patch level.
• Segmentation. Does the boundary between the guest network, the office network and the server VLAN hold when someone pushes on it?
• Detection. Did your SOC see any of the above happen?

Scope the test where the money is. For most UK organisations that means infrastructure penetration testing across the internal and external perimeter in one engagement, so the operator can cross the join rather than stopping at a contractual boundary an attacker has never heard of. NCSC frames penetration testing as assurance over your vulnerability management process rather than the primary way you discover vulnerabilities [ NCSC penetration testing ] . That framing is correct and it is the reason both belong in the budget. The scan finds; the test proves the finding process works.

06 What to do this quarter

You do not need a bigger scanner. You need somebody to walk the paths your scanner cannot see, and to tell you which twelve of the 900 deserve a change window this month.

That is the work we do. Red Team Partners takes your estate, walks it the way an attacker would, and hands you the exploit paths that reach real data, ranked by consequence and written so your engineers, your board and your ICO or FCA reporting can all use the same document. You get proof of what opens, the fix for each path, and a retest once you have closed it. Get a free audit and see the twelve findings that matter before someone else does.