A vulnerability scan is software checking systems against a list of known flaws, while a penetration test is a person with written permission trying to break in, and most Houston businesses need the scan first.
Uprite sells both, and the two get swapped on nearly every first call. The FTC Safeguards Rule lists vulnerability assessments every 6 months and penetration testing every year as separate duties, and PCI DSS splits them the same way, yet a cyber insurance renewal form will often just say “pen test” and leave the reader to guess. Scanning sits inside our security plans from $40 per user per month, while a test is its own project quoted by scope, and our page on penetration testing in Houston covers how we run it. What follows is how to tell which one you’re being asked for.
Scanning costs from $40 per user per month inside a security plan and checks your systems against known flaws such as the 1,768 in CISA’s exploited vulnerabilities catalog. A penetration test typically costs several thousand dollars and answers what a person could still reach after the scans are clean. Buy the scan first, buy the test when a rule, insurer, or customer asks, and treat a $1,000 pen test quote as a scan.
What is the difference between a penetration test and a vulnerability scan?
A vulnerability scan uses automated software to compare your systems against lists of known flaws and returns a ranked report, usually scored with CVSS severity ratings. A penetration test is a skilled person working under a signed scope who exploits weaknesses to show how far an attacker could get.
NIST treats these as separate techniques. Its Technical Guide to Information Security Testing and Assessment, SP 800-115, covers vulnerability scanning in section 4.3 and penetration testing in section 5.2. The table puts the two side by side the way a buyer would compare them.
| What you’re comparing | Vulnerability scan | Penetration test |
|---|---|---|
| Question it answers | Which known weaknesses are on my systems today? | Can someone get in, and how far could they go once inside? |
| Who does the work | A scanning tool, with a person sorting out false alarms afterward | A named tester working from a written scope and an authorization letter |
| What lands on your desk | A ranked list of flaws, grouped by system | A report of what worked, the path the tester took, and how to fix it |
| How often | Monthly or continuously, and at least every 6 months under the FTC Safeguards Rule | Yearly where a rule asks for it, or after a major network change |
| What it costs a Houston firm | Included in our security plans from $40 per user per month | Typically several thousand dollars, with scope setting the price |
Both cost lines come from our published rates on the pricing page, and the planning math behind a test sits in our guide to what a penetration test runs in Houston.
What can a scanner find that a tester doesn’t need to?
Anything that already has a public CVE number, and that’s a bigger pile than most owners expect. CISA’s Known Exploited Vulnerabilities catalog lists flaws attackers are using right now. We downloaded version 2026.11.04 on November 4, 2026. It holds 1,768 entries, and 313 of them were added in the previous 12 months.
Of those 313, 220 were flaws published the same year CISA flagged them and 38 were a year old. The other 55 were 2 or more years old, and 30 of those were 5 or more years old, including a 2015 hole in ISC BIND, a 2016 Apache Struts flaw, and a 2015 ProFTPD bug. Somebody’s unpatched server was sitting there the whole time.
By vendor, Microsoft leads with 42 entries across Windows, SharePoint, Office, and Exchange Server. Cisco has 21, Fortinet 12, and Apple and Google 11 each. In all, 67 of the 313 belong to network and security vendors such as Cisco, Fortinet, Ivanti, Citrix, SonicWall, and Palo Alto Networks, 10 sit in remote management tools including ConnectWise ScreenConnect, N-able N-central, and SimpleHelp, and 29 are flagged as used in ransomware campaigns by 20 different vendors. Every one is a named flaw tied to a version number, which is exactly what a scanner such as Nessus or Qualys checks for.
Deadlines tell a similar story. CISA gave federal agencies 3 days or less to patch 153 of the 313 entries, 14 days for 86 more, and 21 days for 66, with the remaining 8 set at 5 or 7 days. PCI DSS asks for scans only quarterly, so a scan can trail a 3-day deadline by up to 88 days.
The Verizon 2026 Data Breach Investigations Report puts exploited vulnerabilities at the start of 31% of breaches, the top entry point, with credential abuse at 13%. A scanner covers the 31%. The 13%, along with a flat office network where every laptop can reach the accounting server, has no CVE number to look up, and that’s the ground a tester covers by trying.
Which one does your Houston business need first?
Size decides a lot of it. The Bureau of Labor Statistics’ Quarterly Census of Employment and Wages counted 3,185 law offices in Harris County in 2025 with 27,494 jobs between them, about 8.6 people per office, and 3,914 physician offices averaging 11.7. At that size nobody on staff owns the network, a scan would hand over a list nobody has time to read, and the first purchase is an inventory. Our network assessment is no charge, read-only, and ends with a device list and a ranked findings report.
The same data counts 694 CPA offices with 10,896 jobs, 241 new car dealerships with 20,033, and 118 mortgage and loan brokers with 540. Those 3 categories add up to 1,053 Harris County establishments in the group the FTC Safeguards Rule reaches, and they owe vulnerability assessments at least every 6 months plus an annual test unless an exception applies. A broker averaging 4.6 employees may well hold records on fewer than 5,000 consumers, which the next section explains.
Plants are a different case. Harris County has 1,345 fabricated metal shops averaging 32 employees and 629 machinery makers averaging 53, and plenty of them run production equipment on the same network as the front office. Scanning is still the first step, but the scan needs gentle settings and a list of fragile controllers to skip, because an aggressive scan can knock an old PLC offline. A test of the office side can then run after hours.
Now picture a Galleria professional firm that scans monthly, closes findings within 30 days, and has a cyber insurance renewal form asking for a recent penetration test report. Scanning has done its job there, and the firm is ready to buy a test, ideally with a retest bundled in. CISA also offers free external scanning to eligible organizations through its Cyber Hygiene program.
Do compliance rules require a scan, a test, or both?
Often both, although no Texas law forces a private business to run a penetration test. A federal rule, a card standard, or a customer contract is what usually does it, and the table covers the three we get asked about most.
| Rule | Scans | Penetration test |
|---|---|---|
| FTC Safeguards Rule, 16 CFR 314.4(d)(2) | Vulnerability assessments at least every 6 months | Annual, unless you run continuous monitoring |
| PCI DSS v4.0.1, Requirement 11 | Internal and external scans at least quarterly, with external scans run by an Approved Scanning Vendor | At least every 12 months and after significant changes |
| HIPAA Security Rule proposal | Proposed every 6 months | Proposed yearly, and not final as of November 2026 |
The FTC row has an escape hatch. A firm with effective continuous monitoring can meet the rule without the annual test, according to the text of 16 CFR 314.4, and a firm holding information on fewer than 5,000 consumers is excused from that clause under section 314.6. Counting customer records before paying for a test you may not owe is worth an afternoon. That’s our reading of the rule, so have your attorney confirm it. To rank findings against the business before spending anything, a cybersecurity risk assessment does that job.
Card standards come from the PCI Security Standards Council, and your acquiring bank decides what proof it wants. HIPAA’s testing language is still only a proposal in the Federal Register, so a clinic shouldn’t budget around it yet, though scanning is easy to defend while the rule is pending.
How can you tell a real pen test from a scan with a new label?
A real test comes with a named tester, an hour count, and a sample report, while a relabeled scan comes with a tool name and a PDF.
The labor math shows why. GSA’s public rate data lists 486 vulnerability analyst rates with a median of $139.25 an hour, against $155.78 for penetration testers, so the 2 sit only about 11% apart. A scan is cheap because software does most of the work on a schedule, and the person isn’t paid much less. At $155.78 an hour, a $1,000 quote buys about 6 hours of tester time, while our planning range of $3,700 to $18,700 assumes 3 to 15 tester-days, or 24 to 120 hours.
NIST describes a test in 4 phases, planning, discovery, attack, and reporting. The attack phase is where a tester tries to gain access, escalate privileges, and move to other systems, and a report with no attack phase in it is a scan with a cover page. A scan report runs long and sorts by CVSS severity, and the pages look alike. A test report reads as a sequence, with an entry point, the steps from there, and what the tester could reach at the end, and sometimes it concludes that nothing worked. Our walkthrough of a penetration test report shows what each section should contain.
A solid quote names the systems in scope and the ones off limits, says whether a retest is included, and identifies the person who signs the authorization letter, who has to own the systems being tested. We do both, so independence belongs on the list too. A provider that manages your network and also tests it is grading its own work, and the client should ask how the tester stays separate from the team running the systems.
What order should a Houston firm buy them in?
Inventory first, then scans, fixes, the test, and a retest. That sequence costs the least, and it means the tester’s paid days go to problems a scanner can’t see.
- Inventory every device, server, and cloud account, including the Windows file server in the closet that nobody has logged into since the last office move.
- Run internal and external scans at least quarterly to meet PCI DSS, every 6 months to meet the FTC rule, and monthly if you want new flaws caught within weeks.
- Patch or retire what the scans flag, starting with anything that appears in CISA’s catalog, since those flaws already have confirmed attacks behind them.
- Book the penetration test about once every 12 months, with a scope that matches what the rule or customer asks for.
- Retest the findings, because a finding isn’t closed until someone proves it’s closed.
The Atlantic hurricane season runs June 1 through November 30, and we schedule testing around hurricane watches, month-end close, and payroll runs, because a test squeezed into a bad week gets rushed or cut short. A storm rebuild or an office move resets the inventory, so the network gets scanned again before anyone tests it. Our guide on how often to pen test in Houston covers the cadence in more depth.
Uprite is a managed IT and cybersecurity provider that has served Houston, Dallas, and San Antonio businesses since 1999, so we’re biased toward owners who scan before they test. A firm that already scans weekly, has someone fixing what turns up, and has an insurer waiting on a test can skip ahead without us.
Our cybersecurity cost guide for Houston prices the rest of the security budget around these two purchases, and our statewide guide to penetration testing vs vulnerability scanning for Texas businesses goes deeper on the compliance side. A breach that touches 250 or more Texans must be reported to the Texas Attorney General within 30 days, and those reports are posted publicly.
What Houston owners ask before they buy
Is a vulnerability scan the same as a penetration test?
No. A scan is automated software that lists known flaws, and a penetration test is a person with written permission who tries to exploit them. NIST’s SP 800-115 gives each its own section, 4.3 for scanning and 5.2 for testing, and the test costs more because skilled labor is the main expense.
Do I need a penetration test if I already run scans?
Only if a rule, insurer, or customer asks for one, or if you want to know what a person could reach that a scanner can’t see. The FTC Safeguards Rule and PCI DSS both name an annual test, but a firm under the FTC’s 5,000-consumer threshold is exempt from that clause, and counting records first can save the fee.
What does a scan cost compared with a pen test in Houston?
Scanning is included in Uprite’s managed security plans from $40 per user per month, and our network assessment is no charge. A penetration test typically runs several thousand dollars, with a planning range of about $3,700 to $18,700 for 3 to 15 tester-days at the $155.78 federal median rate.
Is a $1,000 penetration test real?
Almost never. At $155.78 an hour that’s about 6 hours of tester time, and scoping, testing, and a written report take more than that even for a small network, so the work is usually a scan. A tester’s name and a sample report settle it quickly.
Does the FTC Safeguards Rule apply to a small Houston firm?
It can. The rule reaches non-bank financial businesses such as CPA firms, mortgage brokers, and auto dealers, and Harris County has 1,053 establishments in those 3 categories. The testing clause excludes firms holding customer information on fewer than 5,000 consumers, so count first and ask counsel to confirm.
Can Uprite do both for a Houston business?
Yes. Uprite runs recurring vulnerability scans inside its security plans and performs penetration tests itself, quoted by scope, and it also writes the scope, closes known gaps first, and turns findings into a tracked fix list. When we already manage a network, the client should ask how the testing stays independent of the people running it.
Send us the request that’s asking for a test, whether it came from an insurer, a customer, or an auditor. We’ll tell you in writing whether you need a scan or a penetration test, what to fix first, and what a sensible scope looks like. Our average first response is 5 minutes.
Talk to a Security ExpertPrefer email or a phone call? Reach the team through our contact page, and if you’d rather keep security in-house with outside help on monitoring, see managed security services in Houston.
