Security experts commonly use automated tools for initial vulnerability scans. However, the essence of penetration testing is to use real people's experience and capabilities to discover complex vulnerabilities and simulate real attack scenarios.
That is why the main part of the process is manual, which provides complete coverage of web application security.