Penetration testing requirement
The obligation in several frameworks and insurance policies to have security testing performed periodically by an independent party.
PCI DSS requires it annually and after significant change. SOC 2 examinations commonly expect it. Cyber insurers increasingly ask whether one has been done and what happened to the findings.
A vulnerability scan does not satisfy a penetration testing requirement. Auditors look for evidence of manual testing, and just as importantly for evidence that findings were remediated and verified.
Where this comes up
Penetration testing requirement sits inside our compliance and frameworks work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.