ChatGPT
Claude
Perplexity
Gemini
Meet your local partner
At a glance
- Assessment: broad, repeatable, remediation-focused.
- Penetration test: narrow, scenario-based, requires written authorization.
- Ask whether a retest after fixes is included.
Vulnerability assessment vs penetration test
Swipe or scroll sideways to compare all options.
| Difference | Vulnerability assessment | Penetration test |
|---|---|---|
| Price basis | Asset count, scan type, validation and reporting | Target scope, testing depth, time and retest requirements |
| Main question | What weaknesses are present? | What can an authorized tester actually achieve? |
| Typical approach | Discovery, scanning, validation and prioritization | Scoped manual and automated testing with controlled exploitation |
| Typical output | Findings with affected assets, severity and remediation | Demonstrated paths, impact, evidence and corrective actions |
| Breadth versus depth | Can cover many assets consistently | More detailed investigation of an agreed target set |
| Repetition | Useful as an ongoing or recurring process | Often scheduled around risk, change or assurance requirements |
| Operational controls | Credentials, scan windows and exclusions | Explicit written authorization, rules of engagement and stop conditions |
| What it does not prove | That every finding is exploitable in context | That untested systems or future changes are safe |
| Main limitation / extra cost | A finding list does not prove exploitability or business impact | Untested assets remain outside the conclusion; remediation/retest scope affects cost |
| Best fit (Sigma assessment) | You need recurring visibility into vulnerabilities across a defined asset set | You need evidence of exploitable paths and impact within an authorized target scope |
| Official sources | Tenable: Penetration testing principles Ingram Micro: IT lifecycle services |
Ingram Micro: IT lifecycle services |
Source: Tenable’s assessment and penetration-testing guidance. There is no standard price for either service; two quotes need the same scope before their cost can be compared.
Which should come first?
If the business does not have an accurate asset list or has a large backlog of obvious missing updates, an assessment can create a practical starting point. Fixing known weaknesses before a penetration test can make the later test more useful.
If the business needs to evaluate a particular internet-facing application, a sensitive workflow or a specific attack path, a scoped penetration test may be appropriate. The request should identify the objective rather than merely asking for a “security check.”
The deliverable changes the value
A scanner export alone is different from an analyst-reviewed report that removes false positives, explains impact and assigns remediation priorities. Similarly, a penetration test should provide usable evidence and corrective guidance, not only a dramatic summary of what was possible.
Ask whether a retest is included. A finding marked fixed by the internal team is not the same as a verified correction. The time allowed for remediation and the scope of retesting should appear in the proposal.
Buy the service that answers the question
Choose an assessment for broad visibility and a repeatable remediation process. Choose a penetration test for a defined validation objective after suitable authorization and preparation. If a customer or insurer specifies a particular deliverable, have the provider map its scope to that requirement before work begins.
Questions to ask before you buy
- What decision will the results support: remediation planning, a customer requirement or an insurance form?
- Which systems are in scope, and which are excluded?
- Is a retest after fixes included?
- What evidence and format does the report provide?
What Hawaiʻi businesses should check
If a customer, insurer or government contract in Hawaiʻi specifies a testing standard, give that requirement to the provider before scoping so the report meets it.
Frequently asked questions
Does a clean test certify the whole business as secure?
No. The result applies to the tested scope and time. Changes and untested systems remain outside that conclusion.
Sources and pricing notes
Prices and specifications checked September 27, 2026 against the providers’ published sources below. Prices are US list or published rates before taxes, fees and equipment unless stated; offers change, so confirm the current terms before you buy.
- Tenable. Penetration testing principles
- Ingram Micro. IT lifecycle services
How Sigma is paid. Sigma is a Hawaiʻi technology advisor. Provider or reseller partners compensate Sigma; product and service prices may include a margin. No procurement fee applies. Standalone consulting is quoted separately.