Difference between vulnerability assessment and penetration testing