Vulnerability Management vs. Penetration Testing

To prevent incidents, companies have a couple of options available: Vulnerability managment/assessmet and penetration testing. Both are equally as important in analyzing a system for weaknesses and making improvements. The former is a broad examination of the policies and security measures in place and the latter tests that specific measures are indeed providing sufficient security. Companies tend to be squeamish about allowing penetration testing. The assessment is a good starting point in identifying weaknesses and can help to narrow down what needs to be tested.
Penetration testing is specific enough to allow only necessary patches. Vulnerability, unlike penetration testing, does not simulate real world attacks on systems. Security risk assessment only identifies missing patches, whereas penetration testing bases its recommendations on tangible threats.