Vulnerability assessment vs. penetration test

A vulnerability assessment is a systematic examination of a system to determine the adequacy of its security measures and identify security deficiencies; it typically covers activities such as port and service identification, vulnerability scanning, security configuration review and password cracking. A penetration test mimics real-world attacks, often launching real attacks on real systems, to find ways around security features. No single technique gives a complete picture: a pen test usually builds on discovery and vulnerability scanning rather than replacing them.[1][2][3][16]

Testing knowledge levels

Black box (no knowledge of internal structure and implementation detail), white box (explicit and substantial internal knowledge, e.g., source code and network diagrams), and gray box (some knowledge). NIST also calls these basic, comprehensive, and focused testing.[4][5][6]

Static vs. dynamic application testing (SAST/DAST)

SAST analyzes source code or compiled code to find security flaws and can run inside the developer's IDE, so it catches issues during development. DAST scans a running web application from the outside, black-box style, finding issues such as cross-site scripting, injection, and insecure server configuration.[7][8]

Audit types

Assessments can be run by internal assessors or by engaged third parties (for example auditors or contractor support staff), which can offer an independent view internal assessors may not be able to provide. External audits are performed by outside entities such as regulatory agencies, and a SOC 1 examination covers controls at a service organization that are likely to be relevant to its user entities' internal control over financial reporting. The key variable is independence: independent assessors are impartial and free of conflicts of interest, and may come from within the organization or be contracted from outside.[9][10][11][17]

Key Performance Indicators vs. Key Risk Indicators

KPIs measure progress toward intended results; KRIs measure risk. Both should be set up to warn when risk tolerance boundaries are being approached. A lagging indicator tracks outcomes, while a leading indicator tracks what precedes incidents: an audit control that shows whether a breach occurred looks backward, but a KRI such as rising external reconnaissance scanning provides a leading metric that might indicate an impending attack.[13][14][18]

SAST vs. DAST

SAST examines source or compiled code during development and flags well-known flaws such as SQL injection and buffer overflows in the code itself. DAST scans the running web application from the outside and catches issues that only appear during execution, like insecure server configuration exposed at runtime.[7][8]

SOC 1 vs. SOC 2

SOC 1 covers controls at a service organization relevant to its clients' internal control over financial reporting. SOC 2 covers controls relevant to security, availability, processing integrity, confidentiality, and privacy, so it is the one that speaks to a vendor's security. SOC 3 covers the same areas as SOC 2 with less detail.[11][12]