Penetration test or data breach check: what is the difference?

A penetration test actively checks whether your systems can be attacked and requires you to commission it. A data breach check instead checks whether data of your company has already appeared in external sources, without touching your systems. They answer different questions and complement each other; neither replaces the other.

What a penetration test does

In a penetration test, specialists simulate attacks with your permission on clearly defined systems, such as a web application, a network or a cloud environment. They look for vulnerabilities, assess the risk and deliver a report with findings and recommendations. The effort depends on the scope and includes coordination, execution and reporting.

What a data breach check does

A data breach check evaluates external sources and shows whether your domain or email addresses appear in known incidents. It does not test any of your systems, needs no access to them and provides a snapshot within a short time.

The key differences

Question: can attackers get in? (penetration test) – is data already out there? (data breach check)
Method: active, authorised attacks – evaluation of external sources
Access to your systems: yes, after commissioning – no
Effort: a project with coordination – a short check
Result: a findings report on vulnerabilities – indications of affected addresses or incidents

When do you need which?

A new application or a major release: penetration test
Suspected stolen credentials or a regular check: data breach check
Customer requirements, ISO 27001 or NIS2: often a penetration test together with further measures
Limited budget and an unclear starting point: begin with the free data breach check and derive further needs from it

And the vulnerability scan?

An automated vulnerability scan is cheaper and faster than a penetration test but less thorough. It finds known vulnerabilities but does not chain them the way an attacker would. It is a complement, not a replacement.

Using both together

If a data breach check shows that credentials of your domain are in circulation, change passwords and enable multi-factor authentication. A penetration test can then check whether such credentials could be used to get further into your systems.

Transparency note

BreachFinder is an offering of APASEC ApS. APASEC also offers penetration tests. This guide is nevertheless written so that you can choose the check that fits your question, regardless of provider.

Frequently asked questions

Does a data breach check replace a penetration test?

No. The check shows what is known in external sources and tests no systems. A penetration test checks whether your systems can be attacked.

Does a penetration test need permission?

Yes. Systems may only be tested with the explicit permission of the responsible party. A test without permission can be a criminal offence.

How often should you test?

That depends on risk and requirements. Tests are usually done when triggered, for example after major changes, and repeated regularly.

Is your domain affected? The free BreachFinder check shows known data breaches for your domain.

Related guides

Updated: 2026-09-26. General information, not legal advice.