Vulnerability assessments are conducted to identify all vulnerabilities.  Penetration testing has been in vogue to test resilience of security layers. Challenges with these assessments are:

• Security assessments are point-in-time. Today, we need more frequent assessments than these compliance driven, periodic assessments
• Penetration tests call for experienced hackers
• Vulnerabilities found aren’t necessarily prioritized to address the highest risks first
• Techniques used are limited to expertise of hackers engaged – several other techniques remain untested
• Expensive to have these tests done through the year