Three types of technical testing
If you want to know how well your IT environment is secured, you’ll soon come across the terms scan, audit and pentest. They are often used interchangeably, but each answers a different question.
- Vulnerability scan: automatically looks for known weaknesses, such as missing updates or exposed services. Quick and broad, but not in-depth.
- Configuration audit: checks how your systems are configured, for example the security settings and access rights in Microsoft 365 and Azure.
- Pentest: goes a step further. Within agreed rules of engagement and with your written permission, we test whether weaknesses can actually be exploited, just as an attacker would.
Which one should you choose?
The right choice depends on your question. If you want a first broad view of known weaknesses, a scan is a logical starting point. If you want to know whether your cloud environment is set up properly, a configuration audit is the right fit. A pentest makes sense if you want to know what an attacker could really achieve, for example for a critical application or at the request of a customer or insurer.
So a pentest isn’t automatically better. Without a prior understanding of your environment, it often delivers less than a well-scoped audit. That’s why at Cyberwise we don’t run a pentest by default, but decide together whether and when it makes sense.
What to look out for
- A clear scope: which systems, which time frame and which rules of engagement? Put it in writing.
- A clear report: automated results need to be reviewed manually and translated into risk and priority. Limitations should be included too.
- Follow-up: your IT team or IT partner fixes the issues, and a retest confirms whether the findings have really been resolved.
How Cyberwise helps
With our security audits we test your environment based on your specific question, from a targeted configuration audit to a pentest. An audit can be carried out on its own or as a follow-up to the Cyberwise Baseline.