Penetration Tester vs Vulnerability Assessor

Question

I am facing a lot of confusion in understanding the difference between a Penetration Tester and a Vulnerability Assessor. I don't need a comparison table, etc. I just need the difference explained in a Simple Way. Thanks

Answer 1

This is a very common confusion because when you look at what a Penetration Tester does and what a Vulnerability Assessor does, you won't see much difference. Let me put it in simple words for you. 

Both Penetration Tester and Vulnerability Assessor do the same thing i.e., find vulnerabilities, try to exploit them and then report the issue to the company so that the company can increase the security. But the difference comes in, what kind of companies they do this for.

A Penetration Tester finds vulnerabilities for a company that has covered and provided security to the application/software as much as they could think of. Now, they want to find if there are other vulnerabilities that they missed. Here, a Penetration Tester helps them find these issues.

There are few companies that have not provided security to application/software. They know that there are issues, but they do not know how to prioritize those issues. So, a Vulnerability Assessor goes through these issues and helps prioritize which issue should be addressed and solved first.   

To know more about it, it is recommended to take the Master's in CyberSecurity Program today.

Answer 2

Hello Vidhyut, A Penetration tester manually conducts an assessment on a target to uncover vulnerabilities by exploiting them. The goal is to gain unauthorized access through exploitation which can be used to emulate the intent of a malicious hacker. A pentester often uses following phases:

• Reconnaissance
• Scanning and enumeration
• Exploitation
• Post-exploitation
• Covering tracks

While a Vulnerability assessor, or VA, identifies threats and vulnerabilities on a target by using automated vulnerability scanners. This sometimes includes a range of manual testing with additional tools to further evaluate the security of applications or networks and to verify vulnerabilities discovered by the scanning applications.