// Decision comparison
Manual pentest vs automated security scanner
Quick answer
Automated scanners and manual pentests solve different problems. A scanner sweeps dependencies, versions and known misconfig in minutes: cheap and repeatable. A manual pentest chases what needs reasoning: breaking access control, chaining IDOR, bypassing a billing flow, finding the tenant that can read another tenant’s data. A scanner answers "is there a known CVE here?"; a pentest answers "can a real attacker reach the data or the money?".
Rule of thumb: always run a scanner (it is cheap, continuous hygiene). Hire a manual pentest when money, customer data or a B2B sale is on the line, because that is where logic flaws live, and no scanner finds a logic flaw.
What each one finds (and what slips through)
It is not "one is better". It is about where each one can see. Scanners have high recall on catalogued vulnerabilities and zero recall on business rules, because they do not understand what your product should or should not allow.
| Flaw type | Automated scanner | Manual pentest |
|---|---|---|
| CVE in dependency / outdated version | Finds it well | Finds it, not the focus |
| Header, TLS and weak config | Finds it well | Confirms and prioritizes |
| IDOR / access to another tenant’s data | Almost never | Primary focus |
| Billing / plan logic flaw | Misses it | Primary focus |
| Auth / authorization bypass | Rarely | Primary focus |
| Chained exploit (real attack path) | Does not do it | Does it, proves it with evidence |
Cost, time and what you get
A scanner is continuous and nearly free day to day; its cost is noise (false positives) and the false confidence of a green report. A pentest is a scoped, authorized engagement that delivers proof: every finding ships with reproduction steps, severity and fix priority, the material that unblocks a B2B sale or a customer security questionnaire.
- Scanner: minutes, recurring, great for catching a dependency regression.
- Manual pentest: days, with NDA and tight scope, controlled evidence.
- The best outcome uses both: scanner as hygiene, pentest when the risk is access, data or revenue.
When NOT to hire a manual pentest (yet)
If your product has no real users, no billing turned on and no sensitive data, a manual pentest is early. The money goes further on a recurring scanner and a first guided review (RET Promptbook or Risk Review) to fix the obvious before you pay for deep testing.
Hire the pentest when: a B2B customer asked for security proof, you are about to process payments or third-party personal data, or you already have a signal that some flow grants the wrong access. That is when manual testing pays for itself.
Frequently asked questions
Does an automated scanner replace a pentest?
No. A scanner finds known vulnerabilities and weak config; it does not understand your product’s business rules, so it misses IDOR, plan bypass and cross-tenant leakage, exactly the flaws that hurt most in a B2B sale, and only manual testing finds them.
So scanners are useless?
Far from it. A scanner is cheap continuous hygiene: it catches outdated dependencies and config regressions before they become incidents. The mistake is thinking "green scan" means "secure product".
Who runs the pentest at RET?
Manual testing is run by Gabriel Lima Ferreira, RET’s founder and lead pentester, with authorization and a tight scope. Every finding ships with reproducible evidence and fix priority.
Can I start cheap?
Yes. If you do not need a full pentest yet, Risk Review reads 1 to 3 sensitive flows and tells you what to fix, what to monitor and what needs manual testing later.