Guide
Audit, vulnerability scan or penetration test: what to order
An automated scan lists likely flaws, an audit ranks them and tells you what to fix, and a penetration test proves what an attacker could do with them. Here are the ANSSI definitions, what a report should contain, and what the GDPR and ISO 27001 really require.
Updated on 18 October 2026 · Figures are sourced at the bottom of the page; opinions are those of IT CyberWall.
Three services that get confused
| Service | What it does | What you receive |
|---|---|---|
| Vulnerability scan | A tool automatically queries your machines and compares what it sees with a database of known flaws. | A list of likely flaws, often long, that needs sorting. |
| Security audit | Auditors examine your architecture, configurations, code or organisation. | A report that ranks the flaws and tells you what to fix first. |
| Penetration test | Auditors put themselves in an attacker’s shoes and check whether a flaw can really be exploited, and with what impact[1]. | Proof of what an attacker could do, step by step. |
The five types of audit according to ANSSI
The framework for qualified audit providers (PASSI) distinguishes five activities[1]:
- Architecture audit: the choice and positioning of equipment, and connections to the internet and to third-party networks.
- Configuration audit: the settings of network equipment, systems, applications and security products.
- Source code audit: flaws in an application’s code.
- Penetration test: exploiting flaws under real attack conditions.
- Organisational and physical audit: governance, procedures, security of premises.
What the report should contain
The PASSI framework sets out the content of an audit report[1]. It is a good checklist for judging any report:
- a summary that non-experts can understand: context, scope, critical flaws and an assessment of the security level;
- a table of vulnerabilities ranked by impact and ease of exploitation;
- recommendations linked to each flaw, ranked by criticality and cost;
- for a penetration test, the course of the test and the method used;
- the limitations: what could not be covered, and the phases carried out by automated tools.
A report that is nothing more than tool output, with no summary or priorities, will not help you decide.
What the law requires, and what it does not
- The GDPR requires, for personal data processing, « a process for regularly testing, assessing and evaluating the effectiveness of the measures » for security (Article 32), at a level appropriate to the risk[2]. It does not specifically require an audit or a penetration test: it is up to you to choose a proportionate process.
- The ISO/IEC 27001 standard is a voluntary standard: a company decides for itself to become certified[3]. It is not a legal obligation, even though a client may require it by contract.
- A PASSI qualification is only mandatory when a regulation or contract requires it. It can be checked on the ANSSI website.
Always a written authorisation
A penetration test means attacking systems: it is only done with the written consent of their owner. The PASSI framework provides for an agreement signed before the audit and, for a penetration test, an authorisation form signed by the client, the audited party and any third parties concerned (your hosting provider, for example), listing the targets, dates and times[1].
What to order?
| Your situation | What fits |
|---|---|
| You do not know where you stand | An architecture and configuration audit, with a summary for management. |
| You want to track progress over time | A regular scan, alongside an audit, never instead of one. |
| A website or application exposed on the internet | A penetration test on that scope. |
| A client or a tender requires proof | Read the requirement: PASSI qualification, ISO 27001 certification and a simple audit report are not the same thing. |
Our audits are described on the Security audit page.
Not sure what to order?
Describe your context and what you are being asked for: we will tell you which type of audit fits.
Sources
Sources consulted on 18 October 2026. Supplier prices are shown excluding tax, in the currency and region of the published price list, and may change: always check the official page before deciding.
- ANSSI – Prestataires d’audit de la sécurité des systèmes d’information (PASSI), référentiel d’exigences v2.1-a (1 September 2023) — cyber.gouv.fr/sites/default/files/document/R%C3%A9f%C3%A9rentiel%20PASSI%20%E2%80%93%20version%202.1-a%20%E2%80%93%20sans%20marque%20de%20r%C3%A9vision.pdf
- CNIL – Règlement européen sur la protection des données, chapitre 4 (article 32) — www.cnil.fr/fr/reglement-europeen-protection-donnees/chapitre4
- ISO – ISO/IEC 27001, Information security management systems — www.iso.org/isoiec-27001-information-security.html