PentrAI pen testing vs vulnerability scanners
A vulnerability scanner identifies hosts, services and software versions and matches them against a database of known vulnerabilities or a set of detection templates. NIST SP 800-115 puts the difference this way: scanners check only for the possible existence of a vulnerability, while the attack phase of a penetration test exploits it to confirm that it exists. An AI pen testing agent carries out that attack phase with a language model choosing each command. Pentr's agent scans, then attempts to exploit what it found and records each finding as verified, not exploitable or a false positive, and the run's evidence is sealed and signed. Scanners fit frequent, broad checks for known issues, including in CI and behind a login. An AI pen test fits when findings need to be tested by exploitation and, with Pentr, when the record of the test has to be verifiable by someone else.
This page expands the answer to “How is this different from a vulnerability scanner?” in the Pentr FAQ. Pentr wrote it. Statements about other tools come from their own documentation, linked under Sources, as it read on 2026-10-21.
Side by side
| Vulnerability scanner | AI pen testing agent | Pentr | |
|---|---|---|---|
| Examples | ZAP, a web application scanner (Apache License 2.0); Nuclei, a template-based scanner (MIT licence). | Strix, an open-source agent (Apache License 2.0); Pentr. | Hosted AI pen testing service. |
| How it finds issues | Identifies operating systems and applications and matches them against the scanner's vulnerability database (NIST SP 800-115, §4.3). Nuclei runs detection scenarios written as YAML templates. | A language model decides which command to run or request to make next, and the agent carries it out with tools such as a shell, an HTTP proxy and a browser. | One agent works through seven fixed phases: pre-engagement, intelligence (passive reconnaissance), threat modelling, vulnerability analysis (including nmap version scans matched to known CVEs and OWASP WSTG checks), exploitation, post-exploitation and reporting. |
| Confirms by exploiting | No. Scanners check for the possible existence of a vulnerability (NIST SP 800-115, §5.2). | Yes: the agent attempts exploits against what it found. | Yes. In the exploitation phase the agent attempts each finding and sets it to verified, not_exploitable or false_positive. Nothing checks that status against the evidence. |
| False positives | NIST notes a high false-positive rate and advises that results be interpreted by someone with networking and OS expertise (§4.3). | Strix's README states that findings are validated with working proof-of-concept exploits. | Findings marked false_positive stay in the report with that status; filter on the status column of the CSV or SARIF export. |
| Behind a login | ZAP scans authenticated parts of an application once authentication is configured. Nuclei takes a secrets file for authenticated scans. | Varies. Strix accepts credentials as an instruction. | No. Every run is unauthenticated. |
| Automation and CI | ZAP offers packaged Docker scans, GitHub Actions and an Automation Framework. Nuclei exports SARIF, JSON and Markdown. | Strix runs in GitHub Actions on pull requests. | A partner API and cron schedules. One engagement runs at a time, and a run cannot be cancelled. |
| Effect on targets | Network scanning generates traffic that may affect hosts; DoS tests can usually be suppressed (§4.3). | NIST notes that penetration testing carries a high risk to systems because it uses real exploits against production systems (§5.2). | Each command is checked against your in-scope and out-of-scope lists, and four DoS tools are refused by name. The documentation lists what the check does not catch. |
| What you get | A list of detected issues, with the scanner's risk rating. | Findings with exploit attempts and, depending on the tool, a report. | A PDF report, SARIF and CSV exports, and an evidence locker: every captured artifact hashed with SHA-256, chained and signed with Ed25519, checkable offline with the open-source pentr-verify. |
| Licence and price | ZAP and Nuclei are free and open source. | Strix's open-source edition is free; you pay your model provider. | Commercial. From €150 a month, billed monthly, or €120 a month billed annually (pricing). |
When to use which
A vulnerability scanner is the better fit when
- you want to check for known vulnerabilities and missing patches across many hosts, often;
- you want a check on every build or pull request;
- the application has to be scanned behind a login, which ZAP and Nuclei support and Pentr does not;
- you need a free, open-source tool you run yourself.
An AI pen test is the better fit when
- you need to know which findings can be exploited, not only which may exist;
- you want findings chained from initial access through privilege escalation and lateral movement;
- you want a penetration test repeated on a schedule, between manual tests (schedules).
Pentr in particular fits when
- the results go to an auditor who needs to check that the evidence has not changed since the run (evidence locker);
- you want findings mapped to SOC 2, ISO/IEC 27001, PCI DSS, NIST CSF, OWASP ASVS or ENS controls (frameworks).
The two are complementary: a scanner run often for known issues, and a penetration test, human or automated, to confirm what can be exploited. Pentr is not a substitute for a human test of an application's business logic; its agent is not directed to the OWASP WSTG business-logic category (what Pentr is).
What Pentr does not do
- Test behind a login: there is no way to pass credentials to the agent (scope).
- Run engagements in parallel, or cancel or pause one (FAQ).
- Check the agent's
verifiedorfalse_positivestatus against the evidence (findings). - Prove that a test was complete: a valid signature shows that the evidence has not changed since it was signed (what verification does not prove).
Sources
- NIST SP 800-115, Technical Guide to Information Security Testing and Assessment (September 2008), §4.3 Vulnerability Scanning and §5.2 Penetration Testing, checked .
- ZAP README, github.com/zaproxy/zaproxy, checked .
- ZAP documentation: Authentication, checked .
- ZAP documentation: Automation, checked .
- Nuclei README, github.com/projectdiscovery/nuclei, checked .
- Strix README, github.com/usestrix/strix, checked .
- pentr-verify, github.com/PentrAI/pentr-verify (MIT licence), checked .
- Pentr documentation: Phases, Rules of engagement, Anatomy of a finding, FAQ.