Vulnerability scanning is an automated assessment that checks your apps and infrastructure for security vulnerabilities. It is commonly referred to as automated penetration testing, but it only detects known issues.
Penetration testing is more like a simulated, ethical hack, where a security professional uses their experience and insight to exploit flaws and misconfigurations in an attempt to compromise systems. This could include known and unknown vulnerabilities.
Penetration testing is usually conducted annually. Since new security flaws are found on a regular basis, scheduling vulnerability scans more frequently can help you keep on top of your security by making sure your systems are protected against the latest threats.