Difference between Web App Pentesting and Web App Security Audit

Question

I'm having a hard time drawing the line between Web App pentesting vs a Web App Security Audit.

For instance, OWASP Testing Guide could be used for both of those cases.

Let's say the pentester and the auditor are working inside the enterprise: they therefore have access to the same resources ie architectures, documentation, etc.

I understand that for a pentester, exploiting a vulnerability is the ultimate goal. But, it looks like the process of discovering the vulnerability for both the pentester and the auditor is the same.

Consequently, the auditor job may look like a vulnerability assessment.

Answer 1

I was debating whether to answer since it may be a matter of opinion to an extent...

Some clients like some names other clients like others. The purpose can be the same and the result as well. So... it varies.

I've done penetration tests against web applications and black/grey box style audits (with and without access to the developer team for questions, etc) and the methodology and the output are the same.

In either case you test the application following a certain methodology to determine whether it is vulnerable to attack, which attacks, to what consequence and how to mitigate these issues. The result is usually a report with a technical risk assessment of a list of vulnerabilities detected including recommendations for mitigation, together with a discussion of the results of some sort.

Answer 2

A security audit follows a strict standard or rules and has more access, used typically for compliance. Pentesting doesn't follow rules it is used to find anything vulnerable without complying to any standards or rules.