ShieldProbe Assess vs vulnerability scanning

Scanner or penetration test? Turn a suspected weakness into testable evidence.

Keep your scanner for inventory and recurring checks. ShieldProbe Assess is a penetration test of agreed web apps, APIs, networks and servers. AI runs the testing, and a named consultant approves each finding before you see it.

See the comparison See the sample report

Illustrative example with fictional data

Observed surfaceGET /api/orders/:id

An endpoint exists.
A response was received.

Question to investigate

Whose order
is returned?

Customer ACustomer B's order

Illustrative finding · SP-014

GET /api/orders/order-b07
Session: customer-a

HTTP/1.1 200 OK
{ "ownerId": "customer-b" }

Impact: Customer A's session returns Customer B's order.

Reviewed and approved by a named consultant

See this finding in the sample report

What each result tells you

Scanners vary, and some confirm exploitation for specific checks. A pentest goes further: it follows attack paths and tests how your application behaves for the roles you agree.

Scroll the table sideways to compare both options. You can also focus it and use the arrow keys.

What each result tells you
Compared on	Vulnerability scanning	Penetration test (ShieldProbe Assess)
Primary use	Find assets, misconfigurations and potential vulnerabilities using configured checks.	Follow attack paths and prove impact within an authorized scope.
Authentication	Credentialed scans look deeper than unauthenticated ones.	Uses the application roles and test accounts you agree to test logged-in workflows.
Business logic	Depends on the checks configured. Application-specific rules usually need manual investigation.	Tests authorization and business workflows against their intended rules, with evidence of what actually happened.
Result quality	Potential issues, some of them false positives, that need triage.	Exploit evidence your team can reproduce, with limitations stated.
Who reviews the result	Your team or your scanning provider triages the results.	A named consultant reviews and approves each finding before you see it.
Deliverable and retest	Scan reports and trend data, depending on the product.	A report with scope, limitations, reproducible request and response, impact and remediation, plus retests of confirmed findings under your engagement terms.
Ongoing use	Recurring exposure monitoring and tracking of known issues.	Retests of confirmed findings, and Continuous (developer preview) tests on the repository events you enable.
Compliance	Some requirements call for scans specifically, such as PCI DSS external ASV scans.	Pentest evidence where a requirement calls for a penetration test. It does not replace required scans.

Scope your assessment

When to scan, and when to pentest

Run your scanner for

Recurring hygiene on your own schedule, asset inventory, and external ASV scans where PCI DSS requires them.

Book a pentest

Before a release that changes authentication or roles, for multi-tenant APIs, when an assessor or customer asks for pentest evidence, and after major change.

Scope your assessment

What you receive

Scope and access
Limitations
Reproducible request and response
Severity rationale
Remediation
Retest record

See the sample report

For supported application findings, Defend and Fix can follow.

Common questions

Should we remove our vulnerability scanner?

No. Keep it for inventory, patching and required scans. Add a pentest where you need proof of what an attacker can actually do.

What access does Assess need?

Black-box testing works for every target type. Grey-box testing, with agreed roles and test accounts, is for web apps and APIs.

How fast is it?

48 hours for an agreed scope, counted from when scope, authorization and access are ready. Added scope is agreed separately.

Is it software or people?

Both. AI runs the testing, and a named consultant reviews and approves each finding before you see it.

Does a clean pentest mean the application is secure?

No test can prove that. A clean result means nothing exploitable was found within the agreed scope, access and time window. Test again after significant changes.

Sources

Details about other products and standards come from the public sources below, reviewed on 20 October 2026 unless dated. If anything has changed, tell us and we will correct it.

Scope your assessment