A vulnerability scan identifies potential weaknesses; a penetration test investigates what authorized exploitation can demonstrate. Choose the approach based on the question the organization needs answered.
Vulnerability scanning vs penetration testing
Vulnerability scanning is an automated process that identifies known weaknesses in systems, software, and configurations. It does not exploit vulnerabilities — it reports them. Penetration testing is an authorized, goal-directed attempt to exploit vulnerabilities to assess actual exploitability and impact. Scanning tells you what might be vulnerable; pen testing tells you what is actually exploitable by a skilled attacker.
When each is appropriate
Vulnerability scanning is ongoing and automated — it should run continuously or on a regular schedule as part of a vulnerability management program. Penetration testing is periodic and manual — it is typically commissioned annually or after significant infrastructure changes. Both are covered in Security Operations (28% of SY0-701).