A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →A vulnerability scan is an automated tool that lists known weaknesses across systems, while a penetration test is a manual engagement where a human actively exploits weaknesses to prove real-world impact. Scans give breadth and run continuously; pen tests give depth and validation. Most mature security programs use both.
Think of the scan as a smoke detector and the pen test as a fire drill. The scan tells you where the risk likely is, cheaply and often. The pen test confirms what an attacker could actually do with it.
Compliance language sometimes blurs the two, so read requirements carefully. PCI DSS, for example, mandates both regular scanning and an annual penetration test, and they are not interchangeable.
traztech delivers scoping the right security testing for startups and growth-stage companies, led by a published security researcher.
Book a callFor a broader look at getting audit-ready, see our SOC 2 readiness work, or talk to a fractional CISO about building a program around it.
Free PDFs, no card
SOC 2 readiness, ISO 27001 gaps, incident response and vendor security, as PDFs you can print or forward. Free, no card.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.
This comes up when a buyer or auditor asks for "a pen test" and somebody on the team offers a scan report instead. They are not interchangeable, and a reviewer who knows the difference will notice immediately.
The practical test is whether a human tried to chain findings into an actual compromise. If the output is a list of CVEs with severity scores and no exploitation narrative, it is a scan.
Generally no. Frameworks and buyers that ask for penetration testing expect human-led testing. Scanning usually satisfies a separate vulnerability management requirement.
Scan first. It is cheaper, it finds the obvious problems, and fixing those before a penetration test means you are paying a tester to find the things a scanner cannot.