Both produce a list of security issues. That surface similarity is why the two get conflated in procurement, and why organisations occasionally discover they bought an automated scan when their customer wanted an assessment.
What a scanner does
A vulnerability scanner compares what it observes against a database of known issues: outdated software versions, missing patches, common misconfigurations, default credentials. It is fast, cheap, repeatable, and genuinely valuable when run continuously.
What it cannot do is reason. It does not know that your checkout flow lets a user skip payment by resubmitting a step, because that flaw exists in no database and matches no signature.
What a tester does
A penetration tester models an attacker: they form hypotheses about how your specific system might be abused, then test them. That covers business logic, chained weaknesses, and authorization gaps that only exist because of how your application is built.
It also produces evidence of exploitability. A scanner reports a potential issue; a test establishes whether it can actually be used, and what it yields.
Chaining is the real distinction
Individually low-severity findings frequently combine into something serious. An information disclosure that leaks usernames, plus weak rate limiting, plus a password policy that permits common passwords, is three medium findings and one account takeover.
Scanners report the three. A tester reports the fourth, which is the one that matters.
You need both
This is not an argument against scanning. Continuous scanning catches the newly disclosed vulnerability in a dependency three weeks after your annual test finished, which testing alone never will.
Use scanning for coverage and currency, testing for depth. Most compliance frameworks expect both, and they expect them at different cadences for exactly this reason.
How to tell what you are being sold
Ask how many days of manual testing are included and who performs them. Ask to see a sample report with the client details removed. Ask whether retesting is included.
A report that lists findings by CVE with no narrative, no chained attack path, and no business impact is a scan. That may be exactly what you need — but you should know which one you bought.