Penetration testing versus vulnerability assessment