- What is the difference between a cybersecurity assessment and a penetration test?
- Should a nonprofit do a cybersecurity assessment or a penetration test first?
- Does a nonprofit need a penetration test?
- What should a nonprofit ask before buying either one?
- What happens after the report, and who fixes the findings?
- What is the first step if you are still choosing between the two?
Within managed IT services for nonprofits, cybersecurity assessment vs penetration test for nonprofits is a question of order, and for most organizations the assessment comes first. Scottship Solutions assesses security gaps and manages remediation for small to midsize nonprofits, with security review from Josh Bass (CompTIA Security+). The assessment sits inside that work, while a penetration test is a separate engagement from an outside firm.
A cybersecurity assessment reviews your controls, configuration and policies and produces a prioritized fix list. A penetration test is a separate engagement in which an outside specialist tries to exploit weaknesses, and Scottship does not run them. Our 10 day Tech Stack Audit already surfaces security gaps as part of its scope.
Not sure which one your insurer or funder is really asking for? Start with cybersecurity services for nonprofits, where we review your controls and rank the gaps worth fixing first. Tell us which systems you run and what prompted the question.
What is the difference between a cybersecurity assessment and a penetration test?
A cybersecurity assessment, also called a security risk assessment, reviews your controls, configuration and policies and ends in a prioritized fix list. A penetration test, also called a pen test or penetration testing, is an attempt by a specialist to exploit weaknesses and shows what an attacker could actually reach. The two answer different questions. The assessment asks what is wrong or missing, and the pen test asks what an attacker can do with it.
A vulnerability scan sits between them and has its own row in the table below. Vulnerability assessment vs penetration test follows the same split: a vulnerability assessment is built around scanning, and a pen test is built around exploitation.
| Option | What it checks | Method | What you get back | Who performs it | Best fit |
|---|---|---|---|---|---|
| Cybersecurity assessment | Controls, configuration, policies, accounts and backups | Review of settings and documents, plus staff questions | A prioritized fix list | A security consultant, including Scottship | Any nonprofit without a recent baseline |
| Vulnerability scan | Known weaknesses in systems and software | Automated tooling that lists findings | A list of findings, not proof anyone could exploit them | A security consultant or a testing firm | A regular check between assessments |
| Penetration test | Whether weaknesses can be exploited and how far an attacker gets | A specialist attempts to break in under written authorization | A report of what was reached and how | A specialist outside testing firm | A nonprofit with a specific trigger |
Should a nonprofit do a cybersecurity assessment or a penetration test first?
As of October 2026, our advice for a nonprofit working mainly in Microsoft 365 or Google Workspace is to start with a cybersecurity assessment. The assessment finds the fixable gaps in your accounts, settings and devices. Most can be given an owner and a fix.
Community IT Innovators takes the same position in its guidance for nonprofits. It argues that an assessment with scanning gives a more useful remediation list for a lower price than a pen test. It also names phishing that leads to wire fraud or credential theft as the likeliest compromise at small and midsized nonprofits.
A pen test bought before an assessment tends to waste money, because it finds what a baseline review would have found first. You pay a specialist to confirm gaps you could have closed already. Our nonprofit cybersecurity guide covers the wider set of protections a nonprofit needs in place.
Does a nonprofit need a penetration test?
Do nonprofits need penetration testing? Only when a specific trigger applies. Five triggers justify commissioning one, and if none of them describes your organization, the assessment and its fixes are the better use of your budget.
- An insurer questionnaire asks for one. Check the exact wording of your form before you buy anything.
- A funder or grant condition names one. Check the exact wording of your award.
- You host servers or other infrastructure yourself. On premises systems carry exposure that a cloud only review does not cover.
- Payment card or health data is in scope. PCI DSS and HIPAA may both apply to this data, so read what your framework says about testing.
- A major system change or launch is coming. A new donor portal or a platform migration changes what an attacker can reach.
For framework detail on the payment card and health data trigger, read our guide to HIPAA, PCI and donor data frameworks.
Community IT Innovators suggests one more test before you spend: ask why you need it and what return to expect, including whether it is only a checkbox on an insurance form. In our view, an assessment with a documented fix list serves you better in that case.
What should a nonprofit ask before buying either one?
Settle the scope and the sign off in writing before any work starts. Whether you are buying an assessment or a penetration test, five questions separate a useful engagement from an expensive PDF.
- What is in scope in writing? External, internal and web application work are separate scopes.
- Who performs it, and how independent are they? Ask whether the firm also manages your systems.
- Is there written authorization and are there rules of engagement? A test without them is unauthorized access.
- What does the report contain? Ask for a sample, and look for ranked findings with fixes.
- Is a retest included? A retest proves the fixes worked.
Penetration tests are performed by specialist third party firms, and Scottship does not run them. Our role is the assessment and the fixes.
Your board or executive committee decides who commissions the work and who signs off on the results. Our guide to cybersecurity governance for boards covers that decision.
What happens after the report, and who fixes the findings?
A report is the start of the work, not the end. The first job is to turn the findings into a ranked remediation list, ordered by how exposed each gap leaves you and how quickly it can be closed. Accounts, email and device settings usually sit at the top, because they are the paths phishing and credential theft use. A pen test report arrives ranked by what an attacker reached; an assessment report arrives ranked by what you can close first, so ask for both orderings if you buy both.
The second job is ownership. Every fix needs a named person and a date, whether that person is your operations lead, a vendor or Scottship. The third job is budgeting, so the fixes compete for funds as a planned list rather than as a surprise after an incident.
A good assessment ends with each finding ranked, matched to an owner and paired with a fix, so the remediation work can be planned and budgeted.
Frequently Asked Questions
How much does a penetration test cost for a nonprofit?
Testing firms quote by scope, and the figure is not published as a flat rate. The cost drivers below decide the quote, so bring answers to each when you ask for one.
| Cost driver | What changes | What to ask the testing firm |
|---|---|---|
| External versus internal scope | An internal test reaches more of your network than an outside only test | Which of the two does the quote cover? |
| Number of systems or addresses | More systems mean more testing time | How do you count systems, and what happens if the list grows? |
| Web application in scope | Web application testing is a separate piece of work | Is our donor portal or website priced separately? |
| Retest included | A retest confirms the fixes held | Is a retest included, and for how long after the report? |
| Report depth | A fuller report with fix guidance takes more effort to produce | Can we see a sample report before we sign? |
Are there free penetration tests for nonprofits?
Ask any testing firm whether it has a charity program and confirm eligibility in writing. Pen testing for charities is worth asking about before you commit. A free test still needs written authorization and a report you can act on, and it does not replace the assessment that tells you what to fix.
Is a pen test required for cyber insurance?
Whether your policy requires one depends on the insurer and the wording of your application, so read the questionnaire line by line. If it asks about penetration testing, ask your broker whether a documented assessment satisfies the question or whether a third party test is required. Scottship Solutions handles the assessment and remediation side, and an assessment shows which questionnaire answers your current controls support.
What is the difference between a vulnerability scan and a penetration test?
A vulnerability scan is automated and lists known weaknesses in your systems. A penetration test is performed by a specialist who tries to exploit those weaknesses and reports how far an attacker could get. Scottship Solutions handles the assessment and remediation side for nonprofits by reviewing controls, configuration and policies, and does not run penetration tests.
Sources
What is the first step if you are still choosing between the two?
Gather the insurer questionnaire or funder wording that raised the question, plus a list of the systems you run. With those two things in hand, an assessment shows whether it covers the request and whether a testing firm needs to be involved at all.
Nonprofit security assessment and remediation is where we start, and we walk you through which option fits your situation. Send us the questionnaire or award wording that raised the question.
Written by
Josh Bass
Cybersecurity Consultant at Scottship Solutions
Josh leads security assessments and compliance audits for mission-driven organizations. He helps nonprofits build defensible security postures, meet HIPAA and state privacy requirements, and respond to threats before they become incidents.
Certifications
CompTIA Security+ Certified
Industries Served
Healthcare & Community Health (HIPAA), Human Services, Child Advocacy, Foundations & Grantmakers