When Which
Choose VA vs pentest by maturity and goal — planning literacy on $LAB_HOST, not stranger attacks.
Visual · when_which
When VA vs pentest literacy. $LAB_HOST only. Original Cyberlium.
Young programs need VA visibility first — pentest validates what VA already prioritized.
Organizations with unknown asset sprawl start with VA: inventory, baseline scans, patch hygiene. Pentest fits when controls exist and leadership needs proof of residual risk — often after VA backlogs shrink. M&A, compliance, and major architecture changes trigger either under contract. Cyberlium teaches decision criteria in notes for $LAB_HOST lab planning — not picking targets on the internet. You will NOT pentest a café because VA found nothing, or VA-scan employer prod without ticket. Next: Contrast Lab.
1. Signals for VA first
No CMDB, irregular patching, new cloud footprint, or post-incident 'what else is broken?' — VA establishes visibility and recurring metrics on owned estates.
On $LAB_HOST lab story: 'new lab VM, unknown services' → VA cycle before any simulated attack narrative.
Command guide
Try these commands — Signals for VA first
═══ LINUX / KALI (Penetration Testing & Service Audit) ═══
Port scan and service banner grabbing against authorized target
Command — copy this
nmap -sV -sC -Pn -T4 -p 21,22,80,443,445,3389 ${LAB_HOST:-127.0.0.1}Enumerate web directories and hidden endpoints
Command — copy this
gobuster dir -u http://${LAB_HOST:-127.0.0.1} -w /usr/share/wordlists/dirb/common.txt -q -t 20 2>/dev/null || head -5 /etc/hostsMetasploit framework module inspection (Safe lab syntax)
Command — copy this
msfconsole -q -x "use auxiliary/scanner/portscan/tcp; set RHOSTS 127.0.0.1; set PORTS 80,443; run; exit" 2>/dev/null || echo "Run in Kali msfconsole"
═══ WINDOWS (Audit Target) ═══ Enumerate open listening ports with process mappings
Command — copy this
netstat -ano | findstr /i "LISTENING"
Primary tools to practice this lesson: curl, grep. Reference sites: CISA Vuln Management (https://www.cisa.gov/topics/cybersecurity-best-practices); FIRST Forum (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Signals for pentest
Mature patching, prior VA backlog addressed, need to test detection/response or critical app before launch — pentest under signed rules with rollback.
Pentest without asset inventory often wastes budget rediscovering what VA would have listed.
3. Both need scope — neither authorize strangers
Decision trees belong in change committees — not Discord polls on who to scan. Lab writes: for $LAB_HOST only, VA is always in scope; pentest waits for Topic 19 with same RoE.
Ship: when-to-use checklist (3 bullets each). Next: Contrast Lab.
4. What you ship: when VA vs pentest checklist
Three signals for VA, three for pentest. $LAB_HOST scenario note. chmod 600.
5. What you record before the next lesson
Date. When-which checklist. File t18-m02-l03-when-which.txt chmod 600.
6. Wrong vs right: stranger nets vs YOUR lab assets
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Pentest dorm LAN because 'VA is boring.' VA-scan employer without change ticket.
- Right: Write when-which checklist for lab planning. Next: Contrast Lab.
Mission: when-which planning note
1) List three signals to start with VA. 2) List three signals pentest might fit (under contract). 3) Apply to $LAB_HOST lab scenario. Never scan strangers to 'decide which.'
Stuck? Ask Cyberlium AI Mentor
Inventory before narrative — VA answers 'what exists' first.
APPLY: An organization with no asset inventory should usually:
APPLY: True or False: Pentest replaces the need for recurring VA.
APPLY: Choosing VA vs pentest for $LAB_HOST in Cyberlium: