What it is#
describes a single engagement that runs two techniques back-to-back. Vulnerability assessment sweeps the estate for known defects using signature and heuristic checks; penetration testing then targets the highest-impact findings and chains them into business-level impact. The pairing is common in regulated industries, where auditors expect both a populated finding register and at least one demonstrated exploit path per release.
Why it matters#
Scanners surface a lot of noise, and testers alone cannot scale across large attack surfaces. closes the gap by using breadth to prioritise depth: the scanner narrows the field, the tester proves what matters. Done well, it produces a shortlist of findings that ship with replayable proof-of-concept evidence rather than a CVSS score alone.
Mitigation direction#
Treat as a continuous motion, not an annual event. Wire scan output into a triage queue, gate release trains on proof-verified findings, and keep sample-safe PoCs alongside fixes so regression tests catch reintroductions.