A scanner tells you what might be wrong, automatically and constantly. A pen tester proves what an attacker can actually do with it — and exactly how far.
"We ran a vulnerability scan" and "we had a penetration test" get used almost interchangeably in status reports, and they describe two genuinely different exercises answering two genuinely different questions. A vulnerability scan is a broad, automated sweep that checks every system it can reach against a database of known vulnerability signatures and software versions, then hands back a list of everything that might be wrong. A penetration test is a manual, goal-directed exercise where a human actually tries to break in — exploiting real weaknesses, including the ones the scan already flagged — to prove what an attacker could really achieve. One produces a list. The other produces proof.