Automated/scaled scanning to find and prioritize vulnerabilities (what exists). Penetration Testing: Manual + tool-assisted simulated attacks to exploit vulnerabilities and show impact (what an attacker can do). Goal: Find security gaps, prove impact, and give remediation steps. Common phases: Reconnaissance → Scanning/Enumeration → Vulnerability identification → Exploitation (pen test) → Post-exploitation/privilege escalation → Reporting & remediation verification.