vulnerability scanning vs penetration test