Why is a penetration test considered to be more thorough than vulnerability scan?

Vulnerability scans do much more than just host discovery and port scanning; they identify known security flaws in applications, operating systems, and network devices.

A penetration test goes beyond identifying vulnerabilities by attempting to actively exploit them, mimicking a real attacker to demonstrate the actual risk and potential impact on the targeted infrastructure, whereas a vulnerability scan merely lists potential weaknesses without exploitation.

This statement is incorrect; penetration tests are often performed by skilled human testers, while vulnerability scans are typically automated.

While some penetration testing tools can be comprehensive, the thoroughness of a pen test comes from the active exploitation phase and human insight, not solely from the tools' comprehensiveness compared to vulnerability scanning tools.