Scan or penetration test
Scan or penetration test: what each one really shows.
An automated external scan lists what is visible and known: services exposed on the internet, outdated versions, credentials already leaked. A penetration test goes further: a person actually tries to get in and shows you how far they get. The scan says "this door looks fragile". The test says "I got in this way, here is the proof". So a scan does not replace a test, but it is often enough to get started.
Three things called a "scan" that should not be confused
The word covers three very different things. At Ryze Cyber they have separate names. The questionnaire is described in detail on the page the free scan, explained.
| Questionnaire ("Free scan") | External scan ("External scan" plan) | Penetration test ("Full audit") | |
|---|---|---|---|
| What it is | A self-assessment in 10 questions, calculated from your answers. | A survey of what an attacker sees of you from the internet. | An in-depth, manual test of the website, the accounts and the infrastructure. |
| Does it touch your systems? | No. Nothing is tested. | Yes, from outside, within a signed framework. | Yes, within the scope and on the dates fixed by contract. |
| What you receive | A score out of 100 and your weak points by area, straight away. | Exposed website and services, known credential leaks, prioritised summary report. | Everything in the external scan, manual web and access tests, a detailed report by severity and a debrief by video call. |
| What it does not show | What you do not know, or wrongly believe you have in place. | What an attacker can really do once a flaw is found. | Anything outside the signed scope. |
| Price published on the website | Free | EUR 490 or CHF 490, excluding tax | EUR 1,490 or CHF 1,490, excluding tax |
Prices taken from the Ryze Cyber home page on 7 October 2026. The amounts are the same in Swiss francs.
What does an automated external scan show?
A tool queries your public addresses and records what answers. This is the principle of port scanning, which the glossary of ANSSI, the French national cybersecurity agency, defines as sending packets to the ports of a machine to work out their state. From there, the scan compares what it finds with flaws that are already known and published.
In practice, an external scan is good at bringing out:
- services open on the internet that should not be;
- software running an outdated version;
- forgotten pages: an old test page, an exposed administration interface;
- credentials of your company already present in known leaks.
What does it not show?
A scan does not reason. It cannot chain two small weaknesses into a big one. It does not understand the logic of your application. It sees nothing of what lies behind a login page, unless it is given an account. Three limits follow:
- Logic flaws escape it: a client who can see another client's invoice by changing a number in the address, for example.
- Rights and accounts are not checked: a reused administrator password, rights that are too broad, no two-factor authentication on a key access.
- The human factor stays out of range: a convincing fake email cannot be "scanned".
A scan also produces false alarms. Without sorting, a long list reassures wrongly or worries for nothing. That is why a prioritised report matters more than the number of lines.
Can an automated scanner replace a penetration test?
No, and the reverse is not true either. Penetration testing is one of the audit activities that ANSSI distinguishes in its requirements for audit providers, alongside configuration audits and source code audits (ANSSI glossary, PASSI entry). It is human work: the tester brings proof that a flaw can be exploited and shows the scenario.
The two complement each other. The scan is fast and can be repeated often. The test is rarer and deeper. The page penetration testing for small businesses details how it runs.
When is a scan enough, and when do you need a test?
The external scan is enough for a first inventory, or for a brochure website with no client area and no sensitive data. Move to a penetration test as soon as one of these sentences is true:
- your clients log in to a personal area or pay online;
- you process sensitive data: health, finance, client files;
- a client or an insurer asks you for proof of testing (see insurance and client requirements);
- you are launching a new application or an AI assistant connected to your data;
- you have never been tested.
How often?
To our knowledge, neither the Swiss Data Protection Act nor the GDPR sets a number of tests per year for an ordinary small business. Both texts ask for security appropriate to the risk. The GDPR, where it applies, asks for "a process for regularly testing, assessing and evaluating the effectiveness" of security measures (Article 32).
A simple benchmark, the one used in the Ryze Cyber free scan: were your website or applications tested less than 12 months ago? Add a test after every major change: website redesign, new client area, change of hosting provider. Between two tests, a regular check of exposed points avoids nasty surprises. That is the purpose of the Blue Team's Watch plan (monthly check, EUR 99 or CHF 99 per month excluding tax).
Who fixes the flaws that are found?
Finding and fixing are two different jobs. The report explains each flaw, its severity and its fix. After that, the fix is the job of whoever runs your systems: your developer for the website, your IT provider for computers and the network, your hosting provider for the server.
If nobody can take it on, that is the role of the Blue Team: it closes the weak points one by one, then checks every month that they stay closed. See Red Team and Blue Team.
Frequently asked questions
Does the Ryze Cyber free scan test my website?
No. It is a 10-question questionnaire: it gives a first idea based on your answers, and nothing is tested on your systems. The technical survey from the internet is the External scan plan, and the manual test is the Full audit.
Is a vulnerability scan legal on my own website?
Yes, if the system belongs to you and you asked for it. Ryze Cyber carries out no test without a signed authorisation contract, and never tests a third-party system without the written consent of its owner.
Can a scan take my website down?
The dates and the limits are agreed with you in the contract. Tests that put availability at risk are excluded by default and are only carried out on explicit request.
Do you need a new penetration test every year?
To our knowledge, no general rule imposes it on an ordinary small business. A test less than 12 months old is a good benchmark, and a new test is justified after any major change. Also check what your clients and your insurer require.
Who fixes the flaws after the report?
The people who run your systems: developer, IT provider, hosting provider. The report gives the fix for each flaw in order of priority. The Blue Team can take care of hardening and monthly follow-up.
Start with the step that costs nothing.
The Ryze Cyber free scan is a 10-question questionnaire. It takes two minutes, the score appears straight away and nothing is tested on your systems.
Read next
Sources
- ANSSI (France), CyberDico: definitions of port scanning, vulnerability and the PASSI requirements, in French
- Regulation (EU) 2016/679 (GDPR), Article 32, EUR-Lex
- Swiss Federal Act on Data Protection (FADP), Article 8, Fedlex
- Ryze Cyber, plans and published prices (taken on 7 October 2026)
Last updated: 7 October 2026