What a vulnerability assessment actually does
A vulnerability assessment is a systematic scan of your systems and network for known technical weaknesses — outdated software versions, missing patches, misconfigurations. The output is a list, ranked by severity, of what's exposed. It doesn't try to break in; it identifies where a break-in could plausibly happen.
What a penetration test actually does
A penetration test starts from that same kind of picture but goes further — under a scope and rules of engagement agreed in writing beforehand, testers actively attempt to exploit identified weaknesses to demonstrate what an attacker could realistically achieve. The output isn't just "this is vulnerable," it's "this is what happens if it's exploited."
Why the order matters
Running a penetration test before a vulnerability assessment is a common, costly mistake — you end up paying for testers to manually rediscover issues a scan would have found in a fraction of the time. The standard sequence is: vulnerability assessment first to build the map, penetration testing second to test the highest-value paths on that map.
Kenyan context
It's common for Kenyan organisations — particularly under pressure from a client security questionnaire or an incoming investor — to request "a penetration test" as a first step, without a vulnerability assessment baseline. RETIS will usually recommend starting with the assessment, since it typically surfaces more issues per shilling spent and makes the subsequent penetration test far more targeted.
A practical checklist
- Has your organisation had a vulnerability assessment in the last 12 months?
- Do you know which of your systems are internet-facing versus internal-only?
- Has a penetration test ever been scoped with written rules of engagement?
- Do you have a process for re-testing after vulnerabilities are patched?
