A water-utility board treats a vulnerability assessment and a full penetration test as the same deliverable. What distinction should the tester emphasize?
Select an answer to reveal the explanation.
Short Explanation
Picture a building inspection versus a supervised break-in drill. The assessment finds and ranks weak spots; the pentest carefully tries to walk through a few of them under permission. Same neighborhood of ideas — different depth of proof.
Full Explanation
Vulnerability assessments focus on discovery, validation of findings, and prioritization without necessarily proving full compromise paths. Penetration tests go further by attempting authorized, controlled exploitation to demonstrate impact under rules of engagement. Conflating the two mis-sets client expectations about evidence depth, risk, and residual uncertainty. Timing, physical access, and social engineering are engagement choices — not the defining split.