Penetration Test or Risk Assessment? Two Different Tests for Two Different Questions

"We want to check whether we are secure." That is a sentence we understand. But it still does not define which test the organization needs.

Two services that come up often are a cyber risk assessment and a penetration test. Both deal with security, and both can uncover problems. But they look at reality from different angles.

A penetration test asks: can a weakness be exploited?

A penetration test usually examines a defined system or environment from an attacker's point of view. For example: an application, infrastructure, an internet-facing service or a network.

The goal is not only to run a tool that reports vulnerabilities, but to understand how certain weaknesses could combine into an attack scenario. It is a very important tool when you want to examine the technical resilience of a system.

A risk assessment asks: what could harm the business?

A risk assessment is broader. It is not limited to whether a technical weakness exists, and it can also examine data, people, vendors, permissions, backups, business continuity, procedures, critical systems and processes.

In other words, the focus is not only on "how do you break in". The focus is on "what could go wrong, and what would it mean".

A system can be hard to break into and still be a risk

Suppose there is a well-protected internal system. A penetration test found no significant weakness. Excellent.

But that same system is critical to the company's operations. There is no proper recovery mechanism for it. Only one person knows how to operate it. And its vendor is not quickly available.

From the business's point of view, there is a significant risk here, even though no way to break into the system was found.

And the other way around: a risk assessment does not replace offensive testing

An assessment can identify that a system is very important. You can review policy, configuration and controls. But sometimes the way to understand whether a practical weakness exists is to carry out a controlled offensive test.

That is why these services do not compete. They provide different kinds of knowledge.

So which test should you run?

The right question is not "which is better?", but what are we trying to learn?

• Do you want to understand the organization's risk picture?
• Do you want to test a new system before it goes live?
• Is a customer requiring a penetration test?
• Has there been a significant change in the infrastructure?
• Has the organization never mapped its risks broadly?

When the goal is clear, it is much easier to choose the type of test.

Why do you sometimes need both?

An assessment may identify that a certain system is critical and needs an in-depth review. Following it, you may decide to run a focused penetration test.

In the other direction, a penetration test may reveal a weakness that points to a broader problem in how the organization manages its systems. One test can lead to the other.

Not "doing a test". Getting an answer.

In the end, the goal is not to tick a box saying a pentest was done or an assessment was completed. The goal is to get information that leads to a decision: what is the risk? What does it mean? What needs to be done? And what matters first?

Security testing with Marom Cyber

Marom Cyber helps organizations choose the test according to the business and technical question they want to answer. Risk assessments and penetration tests are part of our information security and cyber advisory services.

Frequently asked questions