Vulnerability › Module 2 › Lesson 3
When Which
Choose VA vs pentest by maturity and goal — planning literacy on $LAB_HOST, not stranger attacks.
Visual · when_which
When VA vs pentest literacy. $LAB_HOST only. Original Cyberlium.
Opening
Young programs need VA visibility first — pentest validates what VA already prioritized.
Organizations with unknown asset sprawl start with VA: inventory, baseline scans, patch hygiene. Pentest fits when controls exist and leadership needs proof of residual risk — often after VA backlogs shrink. M&A, compliance, and major architecture changes trigger either under contract. Cyberlium teaches decision criteria in notes for $LAB_HOST lab planning — not picking targets on the internet. You will NOT pentest a café because VA found nothing, or VA-scan employer prod without ticket. Next: Contrast Lab.
1. Signals for VA first
No CMDB, irregular patching, new cloud footprint, or post-incident 'what else is broken?' — VA establishes visibility and recurring metrics on owned estates.
On $LAB_HOST lab story: 'new lab VM, unknown services' → VA cycle before any simulated attack narrative.
Command guide
Try these commands — Signals for VA first
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA Vuln Management — https://www.cisa.gov/topics/cybersecurity-best-practices FIRST Forum — https://www.first.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
curl -sS https://www.first.org/ | head -5 grep -E 'VA|pentest' "$HOME/cyberlium-lab/t18-roe.txt" 2>/dev/null || echo 'Document VA vs pentest choice in RoE'
Primary tools to practice this lesson: curl, grep. Reference sites: CISA Vuln Management (https://www.cisa.gov/topics/cybersecurity-best-practices); FIRST Forum (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Signals for pentest
Mature patching, prior VA backlog addressed, need to test detection/response or critical app before launch — pentest under signed rules with rollback.
Pentest without asset inventory often wastes budget rediscovering what VA would have listed.
3. Both need scope — neither authorize strangers
Decision trees belong in change committees — not Discord polls on who to scan. Lab writes: for $LAB_HOST only, VA is always in scope; pentest waits for Topic 19 with same RoE.
Ship: when-to-use checklist (3 bullets each). Next: Contrast Lab.
4. What you ship: when VA vs pentest checklist
Three signals for VA, three for pentest. $LAB_HOST scenario note. chmod 600.
5. What you record before the next lesson
Date. When-which checklist. File t18-m02-l03-when-which.txt chmod 600.
6. Wrong vs right: stranger nets vs YOUR lab assets
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Pentest dorm LAN because 'VA is boring.' VA-scan employer without change ticket.
Right
Write when-which checklist for lab planning. Next: Contrast Lab.
Mission: when-which planning note
1) List three signals to start with VA. 2) List three signals pentest might fit (under contract). 3) Apply to $LAB_HOST lab scenario. Never scan strangers to 'decide which.'
Stuck? Ask Cyberlium AI Mentor
Inventory before narrative — VA answers 'what exists' first.
Knowledge Check
APPLY: An organization with no asset inventory should usually:
Multiple choice
Knowledge Check
APPLY: True or False: Pentest replaces the need for recurring VA.
True or False
Knowledge Check
APPLY: Choosing VA vs pentest for $LAB_HOST in Cyberlium:
Multiple choice