Vuln scans and pen testing are often talked about as if they are interchangeable — but they serve very different purposes.