TesseraPenetration test vs automated security scan
What each one finds, how long it takes and when to choose one or the other.
Last updated: · Hyperion S.r.l.
The short answer
An automated security scan uses tools that check a website for known problems: weak configurations, missing headers, published vulnerabilities, exposed files. It is fast, repeatable and inexpensive. A penetration test is carried out by skilled people who actually try to attack the system, combining tools and reasoning to find the problems no tool knows about, such as flaws in the application's logic. It takes days and costs much more. They are not alternatives: a scan keeps the basics under control, a penetration test uncovers what a scan cannot see.
The differences, point by point
| Automated scan | Penetration test | |
|---|---|---|
| Who runs it | Automated tools | One or more experienced testers |
| Duration | Minutes | From a few days to a few weeks |
| What it finds | Known issues and weak configurations | Also new flaws, logic errors, chains of vulnerabilities |
| Areas behind a login | Usually not | Yes, with agreed test credentials |
| Business logic | No | Yes, for example permissions between roles and payment flows |
| False positives | Possible, to be assessed | Few: every issue is verified manually |
| Suitable frequency | Monthly, and after every major change | Once or twice a year, or before a launch |
| References | Tools such as OWASP ZAP, Nuclei, testssl.sh | Methodologies such as PTES, OWASP WSTG, NIST SP 800-115 |
What an automated scan finds
- Missing or weak HTTP security headers, such as HSTS and Content-Security-Policy (see the guide to security headers).
- TLS configuration: obsolete protocols such as TLS 1.0, weak ciphers, expired or invalid certificates.
- Known, published vulnerabilities in software and components that can be identified from the outside.
- Files and panels exposed by mistake: backups, configuration files, admin pages with default credentials.
- Common web application weaknesses that can be tested automatically.
What is left to a penetration test
- Logic errors: a user who can see another user's orders by changing a number in the address, a discount applied twice, a step in a flow that can be skipped.
- Areas behind the login, tested with accounts of different roles.
- Chains of minor issues that together become serious.
- Manual verification of every result, with concrete proof of exploitability.
Which one to choose
For a company website, an online shop or an application with few roles, a regular automated scan covers most of the common risks at a modest cost, and keeps the basics in order between other activities. A penetration test becomes necessary when the application handles sensitive data or payments, has many roles and complex flows, or when a customer, a contract or a regulation requires it. In that case it pays to fix the issues found by the scan first: the tester does not waste time on the basics and focuses on what only a person can find.
Frequently asked questions
Does an automated scan replace a penetration test?
No. It finds known issues and weak configurations, but not flaws in the application's logic or in areas behind a login. The two are complementary.
How often should I run an automated scan?
Once a month and after every major change to the site, such as a server update, a new plugin or a change of hosting.
Can an automated scan damage my site?
Normally no, but the active part sends many test requests in a short time and may trigger alarms or slow down a fragile site. It should only be run on your own sites or with written authorisation.
Is the Tessera Quick Check a penetration test?
No. It is an automated external scan, without credentials and without manual verification, and the report says so by listing what was not tested.