Vulnerability assessment versus penetration testing