The key difference between vulnerability scanning and penetration testing is that vulnerability scanning identifies known vulnerabilities, while penetration testing goes further by actively exploiting vulnerabilities to assess their impact and identify potential risks.