Ryvx

Sellers use the two terms loosely, so you can pay for one and think you bought the other. Both look for security problems on your website. They work differently, they find different things, and the price gap between them is large.

A vulnerability scan

A scanner checks your site against a list of known problems: out-of-date software, missing security headers, weak HTTPS settings, files that should not be public. It runs in minutes and costs little or nothing. Free tools such as OWASP ZAP, SSL Labs and securityheaders.com cover a lot of it.

A scanner reports what might be wrong, so expect false alarms that someone has to sort through. It also stays outside your site. It does not sign in as a customer and try to read another customer's orders, change a price at checkout or get round a login. Those problems sit in how your site works, not in a version number, and they cause the worst breaches.

A penetration test

A penetration test tries to break in the way an attacker would. The tester signs in, works through your forms and the APIs behind your pages, and tries to reach data or actions they should not. A good test proves each problem it reports, so you know it is real, and tells your developer how to fix it.

A manual test from a UK consultancy usually costs £3,000 to £7,000, often after a scoping call, and the report can take weeks.

Which one you need

A brochure site with no logins, payments or customer data can often get by on regular scans. A site with accounts, a checkout, customer data, an API or a chatbot needs someone to try to break in at least once, and again after big changes. If an insurer, customer or contract asks whether the site has been penetration tested, a scan report does not answer that question.

Where Ryvx fits

A Ryvx Launch Security Review is a test that tries to break in, at a fixed £495 per site. A finding only goes in the report if it comes with working proof, so you do not get a list of maybes. A person checks every report before you see it, and you get the report in 3 to 5 working days with one retest after you fix things. Monthly Monitoring (£100 a month for one site) then runs automated checks every two weeks between tests.

Ryvx is not CREST accredited and not a PCI Approved Scanning Vendor. If a contract or card scheme names either of those, you need a provider that holds it.