| Automated scan | Independent audit | Penetration test | |
|---|---|---|---|
| Who does it | Software | A person who looks at the whole system | A specialist trying to break in |
| Good for | Known mistakes, quickly, every time you publish | Understanding your risks, including ownership and how the business depends on it | Finding how far a skilled attacker could get |
| Can’t tell you | Who should see what in your business | Everything a determined attacker might find | Who owns your accounts, or what happens if your builder leaves |
| Written for | Whoever runs it, often technical | The owner, and whoever does the fixing | Usually technical teams |
| Often needed by | Everyone | Businesses that depend on a home-grown system | Contracts, insurers, regulated work and higher-risk systems |
Automated scans
Run one. They’re quick, often free, and the AI tools have them built in. Lovable, Replit, Bolt and Base44 all have one, and all of them say it isn’t the whole answer.
A scan can spot a table with no rules. It can’t spot a rule that’s present but wrong for your business, such as a driver who can see every depot’s customers. Replit’s own research found that AI-only scans can classify identical flaws differently based on minor changes to the code. Use a scan as a floor, not as a verdict.
An independent audit
This is what we do. Someone looks at your whole system, including the parts that aren’t code: logins, ownership, spreadsheets, connectors, backups, and what happens when someone’s away. We test what we safely can from outside the app. You get a plain-English account of what could happen and what to do first. See an example.
The word “audit” isn’t regulated in this field, so ask any provider, including us, what it actually includes.
A penetration test
A skilled tester tries to break in, within agreed limits, and shows how far they got. The NCSC notes that a well-scoped test gives confidence “at the time of the test”. Pen tests are the right answer when a customer, insurer or regulator asks for one, or when the system carries high risk, such as handling health data or payments itself.
We don’t offer certified penetration tests. If you need one, tell us and we’ll say so up front. Look for a provider with a recognised accreditation, such as CREST. An audit can be a useful step first, because it gets the basics fixed so that you aren’t paying a specialist to find an open door.
How to choose
- A low-risk internal tool with nothing sensitive: run the scan, do our 10 checks, and sort out the logins.
- It holds personal data, or your business relies on it: run the scan, and get an audit.
- A contract or insurer asks for a pen test: get a pen test from an accredited provider. You may well want an audit first.
- You’re selling the business, or raising investment: get an audit for the ownership and risk picture, and ask the buyer what they expect.
Questions to ask any provider
- Will you look at the whole system or just the code?
- Will you test from outside the app, or only read the code?
- Will I be able to understand the report? Can I see an example?
- What will you ask my permission for, and how do you protect live data?
- Do you also sell fixes or rebuilds? If so, how do I know the findings are independent?
- What can’t this tell me?
Be wary of anyone who won’t answer the last one, or who gives you a “secure” badge. No test can prove that a system can’t be hacked.
By Selwyn Doling, VibeTend. Last updated 6 November 2026.
