Penetration test vs security audit: which one for SMEs?

"Do we need a penetration test?" The question comes up often in SMEs, prompted by a client, an insurer or worrying news. Yet a penetration test (pentest) is only one of the tools for assessing your security, and not always the first one to use.

A security audit, a vulnerability scan and a penetration test answer different questions. Telling them apart helps you spend in the right place and receive a report the company can actually act on.

Penetration test, audit, scan: what are the differences?

A vulnerability scan is automated: a tool reviews the equipment and flags vulnerable versions and configurations known to be weak. It is repeated regularly, but it produces false positives and does not tell you whether a vulnerability can really be exploited.

A security audit compares the organization and configuration against a framework, such as the CIS Controls or the NIST Cybersecurity Framework: administrator accounts, backups, updates, multi-factor authentication, procedures. A penetration test, on the other hand, is carried out by specialists who try to get in the way an attacker would, within a given scope and timeframe.

When should an SME run a penetration test?

For most SMEs, the audit and the scan come first: a penetration test run on an environment without multi-factor authentication or recent patches will mostly find already known vulnerabilities, at a higher cost. A penetration test becomes relevant in the following cases.

• You expose a web application or a customer portal on the internet.
• A client, a partner or a call for tenders requires it.
• After a major change: new firewall, migration, new application.
• To check that the measures taken after an audit hold up against a real attempt.

Defining the scope of a penetration test

The scope is set in writing before the start: the IP addresses and domains concerned, applications, Microsoft 365 accounts, internal network, Wi-Fi, possibly social engineering. It also specifies dates, hours, excluded actions (for example anything that could interrupt production) and a contact who can be reached if a problem arises.

The tester can start with no information at all (black box) or with an ordinary user account (gray box), which simulates a compromised computer and often yields more useful results for the same budget.

The company's written authorization is essential: without it, attempting to break into a computer system is a criminal offense in Switzerland. If part of the infrastructure is hosted by a third party, its agreement may also be required.

What does a good report contain, and what comes next?

A useful report contains a summary that management can read, then each finding with its severity, how to reproduce it and a concrete recommendation. Be wary of a report that is just a list exported from an automated tool: that is a scan, not a penetration test.

• Rank findings by severity and exposure, and fix what is reachable from the internet first.
• Assign each fix to a person, with a date.
• Plan a retest to check that the vulnerabilities are actually closed.
• Keep the report somewhere safe: it describes precisely how to get into your systems.

How SysPros helps

SysPros relies on the CIS and NIST frameworks to secure the environments it manages. For a penetration test, we recommend a provider independent of whoever administers the system: we can prepare the scope with them, then implement the fixes you decide on and follow the retest.