What is penetration testing and how does it differ from vulnerability assessment?

Penetration Testing:

• Simulates real attacks to exploit vulnerabilities
• Tests security controls effectiveness
• Provides proof of concept for vulnerabilities
• Limited scope and time-bound

Vulnerability Assessment:

• Identifies and classifies vulnerabilities
• Broader scope, less depth
• Automated scanning with some manual verification
• Provides vulnerability inventory

Key Differences:

• Depth: Pen testing goes deeper into exploitation
• Scope: VA covers more systems, pen testing focuses on specific targets
• Risk: Pen testing carries higher risk of system impact
• Output: VA provides vulnerability list, pen testing provides attack scenarios