While penetration testing examines technical vulnerabilities, a pen test might not examine the administrative or physical controls present within your organization. Your people and your processes introduce equal, if not more, security risks to your organization. Consequently, many organizations believe that information security is all about technology. Therefore, many of their information security preventive controls are technology bound. A penetration test will not examine the effectiveness of your information security policies, or inherent security risks to critical workflows. Often, the risk assessment identifies need for penetration testing or vulnerability scanning. However, the two exercises are distinct from one another.