Scanning is software hunting for known flaws on your systems, while penetration testing is a hired person, with written permission, attempting to get in, and for most San Antonio businesses the scan comes first.
Uprite delivers both for San Antonio clients, and owners mix them up constantly. A renewal questionnaire that asks for a pen test could mean either one. Recurring scanning comes bundled into our cybersecurity services in San Antonio starting at $40 per user per month, whereas penetration testing in San Antonio is scoped and priced as a standalone project. Our penetration testing in San Antonio page shows how a test runs. The sections below help you work out which request you’re facing.
Scanning compares your systems with a list of known flaws and starts at $40 per user per month as part of a security plan. Penetration testing puts a person on your network trying to get in, and it usually costs several thousand dollars. Start with scanning, add the test when a regulator, insurer, or customer demands it, and be skeptical of any $1,000 pen test, because that price buys a scan with a new label.
How does a penetration test differ from a vulnerability scan?
A vulnerability scan runs software across your devices and compares what it finds with public lists of known flaws, then returns a prioritized report. A penetration test hands a qualified person a signed scope and permission to exploit weaknesses, so the result describes how far an intruder could travel, not only what’s unpatched.
NIST draws the same line in SP 800-115, its Technical Guide to Information Security Testing and Assessment. Vulnerability scanning is covered in section 4.3. Penetration testing sits in 5.2, under techniques that validate vulnerabilities, and the guide says most tests chain several weaknesses together to reach more than any single flaw would allow. It also admits a test can break things, which is why the scope and the calendar get agreed up front.
| What you’re comparing | Vulnerability scan | Penetration test |
|---|---|---|
| Core question | Which known flaws exist on my systems right now? | If someone targeted us, how far could they get? |
| Performed by | Software, with an analyst filtering out false positives | A named tester operating under a written scope and authorization letter |
| Deliverable | Ranked findings listed by device | A narrative of the attack path, what was reached, and the fixes |
| Cadence | Monthly or continuous, and never less than every 6 months for FTC-covered firms | Annually if a rule demands it, plus after big network changes |
| Typical San Antonio price | Folded into our security plans, from $40 per user per month | A scoped project, usually several thousand dollars |
Rates live on our pricing page, and our breakdown of cybersecurity costs in San Antonio places both purchases inside the larger security budget.
What can a scanner catch, and what is left for a tester?
Anything with a public CVE identifier, and the supply keeps growing. CISA maintains the Known Exploited Vulnerabilities catalog, a list of flaws with confirmed attacks behind them. The copy we downloaded on November 10, 2026 is version 2026.11.10. It holds 1,779 entries, 323 of them added between November 11, 2025 and November 10, 2026.
Each entry carries weakness tags. The most common were OS command injection (CWE-78) at 20 entries, improper authentication (CWE-287) and code injection (CWE-94) at 19 apiece, path traversal (CWE-22) at 15, and missing authentication for a critical function (CWE-306) at 14. Combine improper authentication, missing authentication, and authentication bypass and 40 of the 323 qualify. Include authorization and access-control tags too and the total reaches 62, or 19% of the year’s additions. CISA also marks 29 as used in ransomware campaigns.
Scanners see these as version strings. Yours will flag that the Ivanti or Fortinet appliance at the edge of your network runs a build with a login bypass, and that matters. What it can’t settle is whether your firewall rules expose that bypass to the internet, or what an attacker holding a hijacked session could reach next, and settling that is the tester’s job. Federal agencies were given 3 days or less to patch 159 of the 323, while PCI DSS only expects scans every 3 months, so a quarterly scan can lag a 3-day deadline by nearly 3 months.
Verizon’s 2026 Data Breach Investigations Report traces 31% of breaches to an exploited vulnerability and 13% to credential abuse. Scanning addresses the first number. Recycled passwords, and a flat network on which any laptop can reach the accounting server, carry no CVE, so they surface only when somebody probes for them.
Which one should a San Antonio business buy first?
Start with headcount. For 2025, the Bureau of Labor Statistics’ Quarterly Census of Employment and Wages recorded 1,072 law offices in Bexar County employing 7,180 people, roughly 6.7 per office. Dental offices averaged 7.6 across 848 locations and physician offices 13.5 across 1,750. Teams that small rarely have anyone who owns the network, so a scan would deliver a list nobody has time to read, and the right first step is an inventory. Our network assessment costs nothing, changes nothing on your systems, and finishes with a device list and ranked findings.
Add 232 CPA offices with 3,074 jobs, 76 new car dealerships with 7,694, and 54 mortgage and loan brokers with 275, and you reach 362 Bexar County establishments in the categories the FTC Safeguards Rule covers. They owe vulnerability assessments every 6 months and an annual test unless an exception applies. Brokers average 5.1 employees, so some may hold records on fewer than 5,000 consumers, which the compliance section below explains.
Manufacturing plays by different rules. Bexar County has 125 fabricated metal shops averaging 19.4 employees and 72 transportation equipment makers averaging 203, and many run production gear on the same network as the front office. Scan gently and give the scanner a list of fragile controllers to skip, since an aggressive scan can take an old PLC offline, and test the office side outside shift hours.
Defense work is its own case, and San Antonio has plenty of it around Joint Base San Antonio. A subcontractor handling controlled unclassified information works from NIST SP 800-171 Revision 2, where requirement 3.11.2 says to scan for vulnerabilities periodically and whenever new ones affecting your systems are identified. The word penetration doesn’t appear anywhere in that document. We read the full text on November 12, 2026. Your prime contractor or assessor may still want a test as evidence, so ask what proof they expect before you buy anything.
Local breach filings point the same direction. The Texas Attorney General’s breach report list shows 25 filings from San Antonio-area organizations between November 7, 2025 and November 6, 2026. Fifteen involved fewer than 5,000 Texans and 9 came from healthcare providers, so these weren’t giants. They were dental offices, a hospice, a pediatric practice, and law offices.
Picture a 9-person San Antonio law firm that scans monthly, fixes findings within 30 days, and now gets a renewal form requesting a recent penetration test report. Scanning did its job, so the firm is ready to buy a test, preferably with a retest included. Our scored ranking of the best penetration testing companies in San Antonio compares the firms that sell one. CISA also provides free external scanning to eligible organizations through its Cyber Hygiene program.
Which rules ask for a scan, a test, or both?
Frequently both, though as far as we’ve found no Texas statute makes a private business run a penetration test. The requirement usually comes from a federal rule, a card standard, or a customer contract.
| Rule | Scans | Penetration test |
|---|---|---|
| FTC Safeguards Rule, 16 CFR 314.4(d)(2) | Vulnerability assessments at least twice a year | Annually, unless continuous monitoring is in place |
| PCI DSS v4.0.1, Requirement 11 | Internal and external scans at least quarterly | At least every 12 months and after significant changes |
| NIST SP 800-171 Rev 2, requirement 3.11.2 | Periodic scans, plus a scan when new flaws affect your systems | Not named in the requirement |
| HIPAA Security Rule | No fixed interval today, with 6 months proposed | No fixed interval today, with yearly proposed |
The FTC row has two exits. Effective continuous monitoring can substitute for the annual test, per 16 CFR 314.4, and section 314.6 exempts firms holding customer information on fewer than 5,000 consumers. Tallying your records takes an afternoon and might save the fee. This is our reading of the rule, so run it past your attorney.
PCI requirements come from the PCI Security Standards Council, and your acquiring bank decides which evidence it accepts. The HIPAA cadences appear only in a January 2025 proposal in the Federal Register, and Fierce Healthcare reports that HHS has pushed its final-rule target to July 2027. Clinics shouldn’t build budgets around the proposal yet, though scanning is easy to justify meanwhile.
How do you spot a genuine pen test versus a relabeled scan?
Genuine tests arrive with a named tester, estimated hours, and a sample report. Relabeled scans arrive with a tool brand and a PDF.
Labor rates explain it. GSA’s CALC data shows a median of $155.78 an hour for penetration testers, so a $1,000 quote covers about 6 hours of human effort, and scoping, testing, and reporting on even a small network takes longer. Our planning range of $3,700 to $18,700 assumes 3 to 15 tester-days, or 24 to 120 hours.
NIST’s four phases are planning, discovery, attack, and reporting. Attack is where the tester uses what discovery uncovered, so a report lacking an attack phase is a scan in a nicer cover. Scan output is long and sorted by severity score. Test output reads like a chain of events, starting at an entry point, following each step, and ending where the tester got to, and occasionally it reports that nothing worked.
Good quotes list the systems in scope and those excluded, state whether a retest is included, and identify the person signing the authorization letter, who must own the systems being tested. Add independence to your checklist. Any provider that both runs your network and tests it is marking its own homework, so ask how the tester is kept apart from the team operating your systems.
What sequence works best for a San Antonio business?
Take inventory, scan, fix, test, then retest. That order costs least and points the tester’s billable days at problems scanners can’t see.
- Catalog every device, server, and cloud account, including the dusty file server in the closet that nobody has touched since the last office move.
- Scan internal and external addresses quarterly for PCI DSS, twice a year for the FTC rule, or monthly if you want new flaws caught within weeks.
- Fix or retire whatever the scans flag, beginning with anything listed in CISA’s catalog, since confirmed attacks already exist for those.
- Schedule the penetration test roughly every 12 months, scoped to what your regulator or customer requests.
- Retest the fixes, because a finding stays open until someone proves it’s closed.
We plan tests around tax deadlines for CPA offices, month-end close, and payroll, since a test jammed into a bad week gets rushed or trimmed. Moving offices or adopting a new line-of-business app resets the inventory, so rescan before anyone tests.
Uprite is a managed IT and cybersecurity provider that has served Texas businesses since 1999, so our bias favors scanning first. Firms that scan weekly, have someone clearing findings, and face an insurer’s deadline can go straight to a test without us.
For the paperwork that usually precedes either purchase, see our cybersecurity risk assessment guide for San Antonio, and for the compliance details, our statewide guide to penetration testing vs vulnerability scanning for Texas businesses. Any breach touching 250 or more Texans must reach the Texas Attorney General within 30 days, and those reports are published.
What San Antonio owners ask before they buy
Is a vulnerability scan the same thing as a penetration test?
No. Scanning is automated software listing known flaws, while a penetration test is a person with written permission who attempts to exploit them. NIST SP 800-115 treats them separately, in sections 4.3 and 5.2, and tests cost more because skilled hours are the expense.
If I already scan, do I still need a pen test?
Only when a rule, insurer, or customer asks for one, or when you want to see what a person can reach that software can’t. Both the FTC Safeguards Rule and PCI DSS name an annual test, yet firms holding records on under 5,000 consumers are exempt from the FTC clause, so count first.
How much do a scan and a pen test cost in San Antonio?
Scanning comes with Uprite’s managed security plans from $40 per user per month, and the network assessment is free. A penetration test usually lands in the thousands, with a planning range near $3,700 to $18,700 for 3 to 15 tester-days at the $155.78 federal median rate.
Does a defense subcontractor near Joint Base San Antonio need a pen test?
Not under NIST SP 800-171 Revision 2 alone. Requirement 3.11.2 asks for periodic vulnerability scans and never mentions penetration testing, though a prime contractor or assessor can ask for one as evidence, so confirm what proof they expect before you buy.
Can a $1,000 penetration test be legitimate?
Almost never. At $155.78 an hour that buys roughly 6 hours of testing, which can’t cover scoping, attack, and reporting for even a small network, so you’re most likely buying a scan. Ask for the tester’s name and a sample report.
Does Uprite handle both scanning and testing in San Antonio?
Yes. We run recurring scans inside our security plans and perform penetration tests ourselves, quoted by scope, and we also draft the scope, close known gaps first, and turn findings into a tracked fix list. If we manage your network already, ask how testing stays independent of the people running it.
Forward us whatever request is asking for a test, whether an insurer, customer, or auditor sent it. We’ll answer in writing with whether you need a scan or a penetration test, what to fix first, and a sensible scope. Our average first response is 5 minutes.
Talk to a Security ExpertWould you rather email or call? Use our contact page, and if you’d like to keep security in-house with outside help on monitoring, look at managed security services in San Antonio.
