A tool automatically checks systems for known vulnerabilities, missing updates and misconfigurations. It is inexpensive, fast and repeatable. It delivers a list but no statement on whether a break-in practically succeeds.
Penetration test
Specialists try, under agreed rules, to penetrate systems like an attacker and escalate privileges. It is more effort but reveals chains of weaknesses that scanners miss. Goal and scope, period and contacts are agreed in writing beforehand.
When which makes sense
Regular scan (for example quarterly) for externally reachable systems and the internal network.
Pentest before launching critical applications, after major changes or when clients and insurers demand it.
Active Directory audit as a targeted configuration review of the directory service.
Afterwards remediation counts: prioritise results, name owners, run a retest.