A vulnerability check of a site: a scanner, an audit and a pentest are not the same
A "scan the site" button finds open ports and old versions. It usually misses someone else's order and a weak role. That needs a different job.
A vulnerability check of a site sounds like one service, and in practice three things are sold under that name. The first is an automated scanner. It is useful as a hint: an old component, a forgotten URL, an odd header. It understands the business poorly. An order page can look healthy and still open under someone else's number.
The second is an audit. A person looks at the state: who can sign in, where forms go, whether backups exist, what is exposed. The third is a pentest: under a contract someone checks whether a scenario works and confirms the finding by hand. Calling a scanner a pentest is a way to get a thick PDF after which the developer still does not know what to fix first.
How to choose the depth
- A landing with a form: a basic audit and tight access. The audit is free for new clients.
- A store, an account area, an API: a website pentest, from $50 per endpoint.
- The site was "scanned" last year: ask whether the fixes were retested.
- You need someone to notice a defacement at night: that is monitoring, not another scan.
Lexora starts with an audit when the scope is not described yet, and moves to a pentest when the site holds other people's data. We use a scanner as a hint inside the work, not as a product to send the client without a review. On a site under maintenance we close the fixes together with development.
Related Lexora services
Already have a scanner report?
We will see what in it is real, and what is worth checking by hand.