SIEM vs Vulnerability Scanner vs Pentest: Three Tasks and Three Modes
The difference between classes takes place along the line "proactive - reactive - verification." As Invicti articulates: the vulnerability scanner works proactively - finds weaknesses before the attacker exploits them. SIEM works reactively - detects suspicious activity when it already occurs. Pentest tools verify - prove that a specific vulnerability is really exploited in this environment. More details - in our Security Validation Guide.
If you put on MITRE ATT&CK, the distribution becomes visual:
Tool class Task Closed ATT&CK machinery The regime
Scanner of vulnerabilities Find known vulnerabilities before operation Risk reduction T1190 - Exploit Public-Facing Application (Initial Access) by identifying vulnerabilities before the attack Proactive
SIEM Detect attacks and anomalies in the flow of events Detection T1046 - Network Service Discovery, T1110 - Brute Force (if there is edge-logs - partially T1595 Active Scanning) Reactive
Pentest utilities Confirm the exploitability and evaluate the real impact Simulation T1190, T1110, T1082 - System Information Discovery Verification
The scanner finds a hole. SIEM records an attempt to get through it. Pentest proves that it is really possible to get through. We remove any link - we get a blind area.
The organization with SIEM, but without a VM scanner, learns about its vulnerabilities only at the time of the attack (when the alert has already arrived at 3 a.m.). Organization with a scanner, but without SIEM does not see when the found vulnerabilities begin to operate. The organization without a pentest does not understand which of the thousands of findings of the scanner are really critical, and which - theoretical risk.
This principle falls on NIST CSF v2.0: scan covers Identify (ID.AM-01 - asset inventory and vulnerability detection), SIEM - Detect (DE.AE-01 - event analysis) and Respond (RS.AN-01 - incident investigation), the pentest verifies the effectiveness of Protect (whether the vulnerabilities are eliminated) and Detect (whether the detection mechanisms work).
For subjects of critical information infrastructure (FZ-187), the principle is even tougher: FSTEC requires not only the availability of information protection tools, but also regular monitoring of their effectiveness - including vulnerability analysis and penetration testing. To refer to "we have SIEM" is not enough, you need a full cycle.
Vulnerability scanners comparison: types and trade-offs
According to the Red Canary classification, vulnerability scanners are divided into several types by target environment:
Network scanners - infrastructure vulnerabilities: open ports, misconfigurements, unpatched software on servers and network equipment
Web Application Scanners (DAST) - vulnerabilities from OWASP Top 10 : Injection (A03:2021), Broken Access Control (A01:2021), Security Misconfiguration (A05:2021)
Database scanners - weak passwords, excessive privileges, unpatched databases
Cloud scanners - misconfigure AWS/Azure/GCP, violations of cloud security best practices
Container scanners - vulnerabilities in Docker images and Kubernetes clusters
Here it is important not to be confused: the network scanner and the DAST scanner are different tools with different tasks. Nessus and OpenVAS scan the network infrastructure on known CVEs and misconfigurations. Burp Suite and OWASP ZAP test web applications for logical vulnerabilities (SQL injections, XSS, BOLA by OWASP API Security - API1:2023). Trying to close both tasks with one tool is a direct path to a false sense of security: the network scanner will not check the business logic of the API, and the DAST will not find the unpatched SSH on the server.
Below is a comparison of the vulnerability scanners of three models: international commercial, open source and Russian certified. Between these three approaches, the issue in Russian organizations is most often resolved.
Criterion Nessus (Tenable) OpenVAS / Greenbone MaxPatrol VM
License Commercial Open source (GPLv2) Commercial
Coverage Network, OS, applications, cloud Network, OS Network, OS, web, database
Vulnerability base Tenable plugins NVT (community feed) CVE + BDU FSTEC
Prioritization CVSS + VPR (Vulnerability Priority Rating) CVSS CVSS + asset context
Register of Russian software No No Yeah
FSTEC Certification No No Yeah
Cost of entry Paid, commercial license Free Enterprise, on request
Integration with SIEM API, Syslog, plugins for Splunk Syslog, API Native with MaxPatrol SIEM
When not fit Subjects of KII (not in the register of the Russian Federation), tight budget State organizations and KII (no certification), teams without GNU/Linux-expertise Small business (high TCO), clean cloud infrastructure
For organizations with the requirement of FSTEC certification in addition to MaxPatrol VM is available RedCheck (ALTEX-SOFT) - security scanner and configuration audit tool, FSTEC certified and included in the Russian Software Register. Separately, Qualys VMDR is a cloud-based platform that, according to Red Canary, goes beyond scanning and includes continuous inventory, prioritization and workflow of vulnerability elimination. It is suitable for large customers with hybrid infrastructure, but there is no software in the Russian software register.
Security scanner selection criteria
Six parameters to look at:
Type of assets. What to scan: network infrastructure, web applications, cloud, containers? There are no universal best vulnerability scanners - everyone is strong in their niche.
regulatory requirements. Subjects of KII (FZ-187), state IP, PD processing systems level ultrasound1-UZ2 - only the Register of Russian software with a protection class not lower than required (FSTEC Order No. 76). OpenVAS, Nessus, Qualys for the main circuit are not suitable. The point.
Scale of infrastructure. On 50 hosts OpenVAS will cope. At 5 000 - you need a platform with distributed scanning and prioritization. CIS Controls v8 (CIS-1 and CIS-2) require continuous asset accounting - the manual approach on scale is falling apart.
Qualification of the team. Open source requires expertise to deploy, set up and support. Commercial solutions - the entry threshold is lower, the cost is higher.
Integration with SIEM. MaxPatrol VM + MaxPatrol SIEM - native bundle. Nessus + Splunk - through plugins and APIs. OpenVAS + any SIEM - through syslog and manual setting of parsers (and this is a separate pain).
TCO, not the cost of the license. Free OpenVAS with two engineers on support can cost more commercial Nessus with vendor support. Consider: license + PHOT + training + time to disassemble false positives.
How to choose SIEM system: from logs to incidents
According to Palo Alto Networks, SIEM platforms experience convergence with XDR and the introduction of AI-driven detection in 2025-2026. But the basic task has not changed: to collect logs from different sources, to correlate events and to highlight what requires the attention of the SOC analyst.
A typical error: The organization buys SIEM, expecting XDR or SOAR features from it. After six months - disappointment, because "SIEM does not catch APT" or "SIEM does not react automatically." He shouldn't. According to the classification of Palo Alto Networks:
SIEM - log aggregation + correlation + detection + investigation
XDR - deep telemetry from integrated protection + response automation
SOAR - orchestration and automation of post-detection tasks (playbooks, enrichment)
Log Management - storage of logs without security-analytics (cheaper, but does not detect threats)
If the task is only the storage of logs for compliance, Log Management will cost less. It is necessary to detect threats - a full-fledged SIEM is necessary.
Criterion Splunk Enterprise Wazuh MaxPatrol SIEM
Type Commercial Open source Commercial (RF)
Deployment On-prem / Cloud On-prem / Cloud On-prem
Payment model By volume of data (GB/day) Free By the number of EPS
Correlation language SPL (powerful, flexible) Built-in rules + XML PDQL + built-in
Sigma compatibility sigma-cli backend splunk Partial, through the converter Through the converter, manual adaptation
Support for Russian IP No specialization Community-support Native (Astra Linux, Postgres Pro)
Register of Russian software No No Yeah
When not fit Hard budget, subjects of KII SLA < 4 h to support, no DevOps-competencies Multi-end international SOC, cloud AWS/Azure
The choice of a security monitoring solution is determined not only by the features, but also by the maturity of the team. Splunk is one of the most serious SOC tools on the market, but without an SPL expert, its potential is not revealed. Wazuh is deployed per day on a single server, but for scales over 500 EPS will require a cluster architecture with OpenSearch - and this is already a full-fledged DevOps task. MaxPatrol SIEM works natively with the Russian IT infrastructure, but is limited to on-premise deployment - for cloud environments will have to look for an additional solution.
Sigma Rules - a separate TCO factor that is often forgotten. Sigma has become the de facto standard for describing detection rules. Splunk converts them plain through sigma-cli. Wazuh supports in part. Russian SIEM-systems, as a rule, require manual adaptation of Sigma-rules under the own language of requests - each update of the set of rules means the hours of operation of the analyst. When calculating TCO, consider not only the license, but also the cost of supporting detection content. In practice, this line of the budget is a surprise.
For organizations with a limited budget Wazuh - real alternative: HIDS, log collection, correlation and compliance-reporting in one open source package. The entry threshold is the basic skills of GNU/Linux administration and the willingness to maintain the economy on their own.
Comparison of Pentest Tools: From Nmap to BAS
The penetration testing tools are the most diverse category. Cymulate highlights four approaches to security checks, each with its limitations:
Method Frequency Coverage Depth The main disadvantage
Vulnerability Scanning Weekly/daily Widely Surface (known CVE) 30-60% false positives
Penetration Testing Quarterly/annually Scoped Deep Depends on the tester's skills, the report in weeks
Red/Blue Teaming 1-2 times a year Wide + deep Maximum Resource-intensive, you can't do it regularly
Breach and Attack Simulation (BAS) Continuously Widely Average Enterprise cost
For manual pentest, the basic set of utilities:
The instrument Appointment License When not fit
Nmap Network intelligence, service detection (T1046) Open source (GPLv2) Testing web applications, exploiting vulnerabilities
Metasploit Framework Operation of vulnerabilities, post-operation Open source (BSD) + Pro Web applications (not the main focus), compliance scanning
Burp Suite Web Application Testing and API Community (free) / Pro (paid) Networking infrastructure, exploitation
OWASP ZAP DAST for web applications Open source Complex API scenarios, manual operation
Each tool closes its own stage of the kill chain. Nmap - intelligence (Network Service Discovery, T1046). Metasploit - operation and post-operation (Exploit Public-Facing Application, T1190). Burp Suite and OWASP ZAP - search for web vulnerabilities from OWASP Top 10: Injection (A03:2021), Broken Access Control (A01:2021), Security Misconfiguration (A05:2021). OWASP ZAP, according to InvGate, is convenient for teams with a limited budget and beginners thanks to integration with CI/CD and REST API.
For organizations with a minimum budget, a bundle Nmap + Metasploit Framework + OWASP ZAP covers the basic pentest: exploration, scanning, operation. All three tools are free.
For those who need continuous validation instead of a quarterly pentest, there are BAS platforms. Free alternatives: MITRE Caldera (emulates adversary behavior by ATT&CK technique) and Atomic Red Team (a set of atomic tests to check the detecting rules). Caldera + Atomic Red Team is a way to check if your correlation rules in SIEM work, without budget for commercial BAS.
The difference between classes takes place along the line "proactive - reactive - verification." As Invicti articulates: the vulnerability scanner works proactively - finds weaknesses before the attacker exploits them. SIEM works reactively - detects suspicious activity when it already occurs. Pentest tools verify - prove that a specific vulnerability is really exploited in this environment. More details - in our Security Validation Guide.
If you put on MITRE ATT&CK, the distribution becomes visual:
Tool class Task Closed ATT&CK machinery The regime
Scanner of vulnerabilities Find known vulnerabilities before operation Risk reduction T1190 - Exploit Public-Facing Application (Initial Access) by identifying vulnerabilities before the attack Proactive
SIEM Detect attacks and anomalies in the flow of events Detection T1046 - Network Service Discovery, T1110 - Brute Force (if there is edge-logs - partially T1595 Active Scanning) Reactive
Pentest utilities Confirm the exploitability and evaluate the real impact Simulation T1190, T1110, T1082 - System Information Discovery Verification
The scanner finds a hole. SIEM records an attempt to get through it. Pentest proves that it is really possible to get through. We remove any link - we get a blind area.
The organization with SIEM, but without a VM scanner, learns about its vulnerabilities only at the time of the attack (when the alert has already arrived at 3 a.m.). Organization with a scanner, but without SIEM does not see when the found vulnerabilities begin to operate. The organization without a pentest does not understand which of the thousands of findings of the scanner are really critical, and which - theoretical risk.
This principle falls on NIST CSF v2.0: scan covers Identify (ID.AM-01 - asset inventory and vulnerability detection), SIEM - Detect (DE.AE-01 - event analysis) and Respond (RS.AN-01 - incident investigation), the pentest verifies the effectiveness of Protect (whether the vulnerabilities are eliminated) and Detect (whether the detection mechanisms work).
For subjects of critical information infrastructure (FZ-187), the principle is even tougher: FSTEC requires not only the availability of information protection tools, but also regular monitoring of their effectiveness - including vulnerability analysis and penetration testing. To refer to "we have SIEM" is not enough, you need a full cycle.
Vulnerability scanners comparison: types and trade-offs
According to the Red Canary classification, vulnerability scanners are divided into several types by target environment:
Network scanners - infrastructure vulnerabilities: open ports, misconfigurements, unpatched software on servers and network equipment
Web Application Scanners (DAST) - vulnerabilities from OWASP Top 10 : Injection (A03:2021), Broken Access Control (A01:2021), Security Misconfiguration (A05:2021)
Database scanners - weak passwords, excessive privileges, unpatched databases
Cloud scanners - misconfigure AWS/Azure/GCP, violations of cloud security best practices
Container scanners - vulnerabilities in Docker images and Kubernetes clusters
Here it is important not to be confused: the network scanner and the DAST scanner are different tools with different tasks. Nessus and OpenVAS scan the network infrastructure on known CVEs and misconfigurations. Burp Suite and OWASP ZAP test web applications for logical vulnerabilities (SQL injections, XSS, BOLA by OWASP API Security - API1:2023). Trying to close both tasks with one tool is a direct path to a false sense of security: the network scanner will not check the business logic of the API, and the DAST will not find the unpatched SSH on the server.
Below is a comparison of the vulnerability scanners of three models: international commercial, open source and Russian certified. Between these three approaches, the issue in Russian organizations is most often resolved.
Criterion Nessus (Tenable) OpenVAS / Greenbone MaxPatrol VM
License Commercial Open source (GPLv2) Commercial
Coverage Network, OS, applications, cloud Network, OS Network, OS, web, database
Vulnerability base Tenable plugins NVT (community feed) CVE + BDU FSTEC
Prioritization CVSS + VPR (Vulnerability Priority Rating) CVSS CVSS + asset context
Register of Russian software No No Yeah
FSTEC Certification No No Yeah
Cost of entry Paid, commercial license Free Enterprise, on request
Integration with SIEM API, Syslog, plugins for Splunk Syslog, API Native with MaxPatrol SIEM
When not fit Subjects of KII (not in the register of the Russian Federation), tight budget State organizations and KII (no certification), teams without GNU/Linux-expertise Small business (high TCO), clean cloud infrastructure
For organizations with the requirement of FSTEC certification in addition to MaxPatrol VM is available RedCheck (ALTEX-SOFT) - security scanner and configuration audit tool, FSTEC certified and included in the Russian Software Register. Separately, Qualys VMDR is a cloud-based platform that, according to Red Canary, goes beyond scanning and includes continuous inventory, prioritization and workflow of vulnerability elimination. It is suitable for large customers with hybrid infrastructure, but there is no software in the Russian software register.
Security scanner selection criteria
Six parameters to look at:
Type of assets. What to scan: network infrastructure, web applications, cloud, containers? There are no universal best vulnerability scanners - everyone is strong in their niche.
regulatory requirements. Subjects of KII (FZ-187), state IP, PD processing systems level ultrasound1-UZ2 - only the Register of Russian software with a protection class not lower than required (FSTEC Order No. 76). OpenVAS, Nessus, Qualys for the main circuit are not suitable. The point.
Scale of infrastructure. On 50 hosts OpenVAS will cope. At 5 000 - you need a platform with distributed scanning and prioritization. CIS Controls v8 (CIS-1 and CIS-2) require continuous asset accounting - the manual approach on scale is falling apart.
Qualification of the team. Open source requires expertise to deploy, set up and support. Commercial solutions - the entry threshold is lower, the cost is higher.
Integration with SIEM. MaxPatrol VM + MaxPatrol SIEM - native bundle. Nessus + Splunk - through plugins and APIs. OpenVAS + any SIEM - through syslog and manual setting of parsers (and this is a separate pain).
TCO, not the cost of the license. Free OpenVAS with two engineers on support can cost more commercial Nessus with vendor support. Consider: license + PHOT + training + time to disassemble false positives.
How to choose SIEM system: from logs to incidents
According to Palo Alto Networks, SIEM platforms experience convergence with XDR and the introduction of AI-driven detection in 2025-2026. But the basic task has not changed: to collect logs from different sources, to correlate events and to highlight what requires the attention of the SOC analyst.
A typical error: The organization buys SIEM, expecting XDR or SOAR features from it. After six months - disappointment, because "SIEM does not catch APT" or "SIEM does not react automatically." He shouldn't. According to the classification of Palo Alto Networks:
SIEM - log aggregation + correlation + detection + investigation
XDR - deep telemetry from integrated protection + response automation
SOAR - orchestration and automation of post-detection tasks (playbooks, enrichment)
Log Management - storage of logs without security-analytics (cheaper, but does not detect threats)
If the task is only the storage of logs for compliance, Log Management will cost less. It is necessary to detect threats - a full-fledged SIEM is necessary.
Criterion Splunk Enterprise Wazuh MaxPatrol SIEM
Type Commercial Open source Commercial (RF)
Deployment On-prem / Cloud On-prem / Cloud On-prem
Payment model By volume of data (GB/day) Free By the number of EPS
Correlation language SPL (powerful, flexible) Built-in rules + XML PDQL + built-in
Sigma compatibility sigma-cli backend splunk Partial, through the converter Through the converter, manual adaptation
Support for Russian IP No specialization Community-support Native (Astra Linux, Postgres Pro)
Register of Russian software No No Yeah
When not fit Hard budget, subjects of KII SLA < 4 h to support, no DevOps-competencies Multi-end international SOC, cloud AWS/Azure
The choice of a security monitoring solution is determined not only by the features, but also by the maturity of the team. Splunk is one of the most serious SOC tools on the market, but without an SPL expert, its potential is not revealed. Wazuh is deployed per day on a single server, but for scales over 500 EPS will require a cluster architecture with OpenSearch - and this is already a full-fledged DevOps task. MaxPatrol SIEM works natively with the Russian IT infrastructure, but is limited to on-premise deployment - for cloud environments will have to look for an additional solution.
Sigma Rules - a separate TCO factor that is often forgotten. Sigma has become the de facto standard for describing detection rules. Splunk converts them plain through sigma-cli. Wazuh supports in part. Russian SIEM-systems, as a rule, require manual adaptation of Sigma-rules under the own language of requests - each update of the set of rules means the hours of operation of the analyst. When calculating TCO, consider not only the license, but also the cost of supporting detection content. In practice, this line of the budget is a surprise.
For organizations with a limited budget Wazuh - real alternative: HIDS, log collection, correlation and compliance-reporting in one open source package. The entry threshold is the basic skills of GNU/Linux administration and the willingness to maintain the economy on their own.
Comparison of Pentest Tools: From Nmap to BAS
The penetration testing tools are the most diverse category. Cymulate highlights four approaches to security checks, each with its limitations:
Method Frequency Coverage Depth The main disadvantage
Vulnerability Scanning Weekly/daily Widely Surface (known CVE) 30-60% false positives
Penetration Testing Quarterly/annually Scoped Deep Depends on the tester's skills, the report in weeks
Red/Blue Teaming 1-2 times a year Wide + deep Maximum Resource-intensive, you can't do it regularly
Breach and Attack Simulation (BAS) Continuously Widely Average Enterprise cost
For manual pentest, the basic set of utilities:
The instrument Appointment License When not fit
Nmap Network intelligence, service detection (T1046) Open source (GPLv2) Testing web applications, exploiting vulnerabilities
Metasploit Framework Operation of vulnerabilities, post-operation Open source (BSD) + Pro Web applications (not the main focus), compliance scanning
Burp Suite Web Application Testing and API Community (free) / Pro (paid) Networking infrastructure, exploitation
OWASP ZAP DAST for web applications Open source Complex API scenarios, manual operation
Each tool closes its own stage of the kill chain. Nmap - intelligence (Network Service Discovery, T1046). Metasploit - operation and post-operation (Exploit Public-Facing Application, T1190). Burp Suite and OWASP ZAP - search for web vulnerabilities from OWASP Top 10: Injection (A03:2021), Broken Access Control (A01:2021), Security Misconfiguration (A05:2021). OWASP ZAP, according to InvGate, is convenient for teams with a limited budget and beginners thanks to integration with CI/CD and REST API.
For organizations with a minimum budget, a bundle Nmap + Metasploit Framework + OWASP ZAP covers the basic pentest: exploration, scanning, operation. All three tools are free.
For those who need continuous validation instead of a quarterly pentest, there are BAS platforms. Free alternatives: MITRE Caldera (emulates adversary behavior by ATT&CK technique) and Atomic Red Team (a set of atomic tests to check the detecting rules). Caldera + Atomic Red Team is a way to check if your correlation rules in SIEM work, without budget for commercial BAS.
