Is a penetration test the same as a vulnerability scan?

No. Compare the actual testing method and deliverables, because automated discovery and human validation answer different questions.

NetSPI and Bishop Fox advertise penetration testing and broader offensive services; their service menus illustrate why a buyer must choose a specific scope. The following procurement questions are editorial recommendations, not claims about every firm's method.

Define target applications, APIs, authentication roles, internal and external network ranges, cloud accounts and excluded systems. Ask how testers validate exploitability and business impact, how much manual work is included, and how critical findings are escalated during the engagement. Confirm whether one retest is included and what happens if remediation finishes after the retest window.

For production or clinical systems, obtain written testing authorization, operating constraints and an emergency stop contact. Compare reports using a sanitized sample: can an engineer reproduce the finding, can the owner understand impact, and can the buyer verify the fix? A large count of low-value findings is not itself a better outcome.