Choose an assessment
Which security assessment do you need?
A simple guide to the main types, and how to choose.
01Guide
Quick chooser
| If you want to… | Start with |
|---|---|
| Check your website or customer portal | Web Application Security Testing |
| Protect the data your apps exchange | API Security Testing |
| Check your iOS or Android app | Mobile Application Security Testing |
| Review your cloud settings | Cloud Security Assessment |
| See what the internet can see of your business | External Attack Surface Assessment |
| Test your servers or networks | Network or Infrastructure Security |
| Check an AI assistant or chatbot | AI Security Testing |
| See whether a weakness can really be used | Penetration Testing |
| Get a broad list of possible weaknesses | Vulnerability Assessment |
| Confirm that fixes worked | Retesting and Validation |
| Not sure | Talk to a Security Specialist |
02Definitions
Common questions, answered simply
03Comparison
Vulnerability assessment compared with penetration testing
| Aspect | Vulnerability assessment | Penetration testing |
|---|---|---|
| Question answered | What weaknesses might we have? | What could an attacker actually do? |
| Approach | Broad search across the scope | Focused attempts to exploit weaknesses |
| Depth | Wide | Deep |
| Best when | You want a wide first view or regular checks | You need proof of real impact, or customers ask for it |
| Typical output | A prioritised list of weaknesses | Validated findings with explanation of impact |
04Comparison
Automated scanning compared with manual testing
| Aspect | Automated scanning | Manual testing |
|---|---|---|
| Strength | Fast and wide coverage of known weaknesses | Finds issues that need human judgement, such as flaws in business logic |
| Limit | Cannot reason about how your business works | Takes more time, so it is focused on agreed priorities |
| Role | Regular checks and first view | Deeper validation |
Most mature programmes combine both. The right mix depends on your systems and goals.
05Scope
How to choose the right scope
- 01
List what you run: websites, apps, APIs, cloud accounts, networks, AI features.
- 02
Mark what is most important to customers or revenue.
- 03
Note what changed recently or will change soon.
- 04
Note what customers, partners or auditors have asked for.
- 05
Talk to us. We will recommend a scope and explain why.