A scan discovers issues but does not attempt exploitation. How does this differ from penetration testing?

1. Penetration testing needs no written scope
2. Scanning identifies candidates; testing validates attack paths
3. Scanning always proves business compromise
4. Scanning removes the need for remediation