Vulnerability assessments identify and quantify vulnerabilities without attempting exploitation. Penetration testing goes further by actively attempting to exploit vulnerabilities to demonstrate their impact. Assessment is about discovery; penetration testing is about proving exploitability.