Why is a penetration test considered to be more thorough than vulnerability scan?

Vulnerability scanners do significantly more than host discovery and port scanning - they also check for known CVEs, misconfigurations, missing patches, and weak credentials, making this characterization inaccurate.

A vulnerability scan passively identifies and reports potential weaknesses without attempting to leverage them, whereas a penetration test actively exploits those weaknesses to confirm they are real and to determine the full extent of potential damage. This active exploitation phase demonstrates actual risk rather than theoretical exposure, and it also uncovers chained attack paths and post-exploitation possibilities that automated scanners cannot reveal.

This statement reverses reality - penetration tests are typically conducted by skilled human testers using manual techniques and judgment, while vulnerability scans are largely automated processes.

Tool comprehensiveness is not the defining differentiator - the key distinction is the active exploitation phase unique to penetration testing, not the breadth of a tool's vulnerability signature database.