pen testing vs vulnerability