The common way for a management or 3rd party to assess your Cyber Security is either through a Penetration Test and Cyber Audit. Doing both of these are also really good way to get a full picture of Cyber security by identifying most gaps and vulnerabilities at that point in time. It is surprising that although we do perform this for many organisations, more organisations only tend to get one of them which I suspect is more related to budget then not wanting to find the vulnerabilities.
To be clear we consider a Cyber Review and a Cyber Audit the same thing so I’ll refer to them as a Cyber Audit.
So how is a Penetration test and a Cyber Audit different?
A Cyber Audit is from the inside of the organisation gaining access to configurations, interviews, policies and procedures to understand how the business works and then identify the weaknesses or vulnerabilities. This means a Cyber Audit is looking at how a business works compared to best Cyber Security practices (such as ISO27001) and identifying what opportunities there are to improve the Cyber Security.
Where as a Penetration test (aka Pen Test) is actually applying real world hacking testing against the implemented systems. It is testing the actual security of what has been applied, so if a Cyber Audit has been performed and the actions implemented, then the Penetration Testing is testing the real world effectiveness of what was implemented.
So the difference between a Cyber Security Audit is making sure the organisation is applying best practices and the Penetration test is checking for any actual vulnerability that could be exploited.
In this Cyber world both are necessary as our experience shows there are always significant vulnerabilities identified in both the Cyber Audit as well as the Penetration Testing.
Vertex provides both Cyber Audit’s and Penetration Testing for many organisations so when you are ready to get a quote or if you have questions reach out.
