Security decisions, compared

A vulnerability assessment identifies and prioritizes known weaknesses across systems, usually with automated scanning and broad coverage. A penetration test goes further by having a skilled tester safely exploit weaknesses to demonstrate real business impact.

Penetration testing focuses on finding and safely exploiting as many weaknesses as possible within a defined scope. Red teaming simulates a realistic adversary pursuing specific objectives, with an emphasis on testing an organization's detection and response, often with limited prior knowledge.

A Security Operations Center, or SOC, is the function and team that continuously monitors, detects, and responds to security threats. Managed Detection and Response, or MDR, is a delivered service that provides those outcomes using a provider's technology, analysts, and processes, often as an alternative or complement to building an in-house SOC.

EDR is technology focused on detecting and responding to threats on endpoints. XDR extends that visibility and correlation across multiple layers such as endpoint, network, identity, and cloud. MDR is a managed service in which a provider operates detection and response on your behalf, and it can be delivered on top of EDR or XDR tooling.

A virtual CISO, or vCISO, provides experienced security leadership on a flexible, often part-time or fractional basis, typically through an external provider. A full-time CISO is a dedicated in-house executive who owns and leads the security program day to day.

ISO 27001 is an international standard for building and certifying an Information Security Management System, resulting in a certification issued by an accredited body. SOC 2 is an attestation performed by a licensed CPA firm that reports on how a service organization's controls meet the AICPA Trust Services Criteria, resulting in a report rather than a certificate.

Automated scanning uses tools to rapidly discover and flag known vulnerabilities across many systems. Manual penetration testing relies on a skilled tester to validate findings, exploit weaknesses, and uncover logic and chained issues that tools often miss.

Web application penetration testing focuses on the browser-facing application, including its pages, sessions, and user-facing logic. API penetration testing focuses on the application programming interfaces behind or alongside the app, examining endpoints, authorization, and data handling that clients and integrations rely on.

Managed Detection and Response, or MDR, is a service focused on detecting, investigating, and responding to threats, often with the provider's own technology and analysts. A Managed Security Service Provider, or MSSP, offers a broader range of managed security operations, such as monitoring, device management, and alerting, with response models that vary by provider.

A security assessment evaluates an organization's actual security posture and risk, often through technical testing and analysis of controls. A compliance audit measures whether the organization conforms to the specific requirements of a standard, framework, or regulation, such as PCI DSS or a SOC 2 examination.

An attack surface assessment discovers and maps the assets, services, and entry points that are exposed and reachable by potential attackers, including unknown or forgotten ones. A vulnerability assessment then examines known assets to find, classify, and prioritize specific weaknesses on them.

Digital Forensics and Incident Response, or DFIR, is the combined discipline of investigating security incidents and performing digital forensics to understand, contain, and recover from them. An incident response retainer is a prearranged contractual agreement that secures access to those services in advance, with defined terms and response expectations.