Vulnerability scanning is an automated process that identifies known vulnerabilities, whereas penetration testing involves actively exploiting and assessing the impact of those vulnerabilities.