The difference in one line each
A vulnerability assessment is a structured search for weaknesses across the systems you put in scope, with every finding ranked by severity. Coverage is the goal.
A penetration test is an authorized attempt to exploit those weaknesses and chain them, to prove what is actually reachable. Proof is the goal.
What each one is good at
An assessment covers more ground for the same effort and gives you a prioritized backlog. It does not tell you which findings a real attacker would combine.
A test tells you exactly that, on a smaller surface. It is the only way to learn that two medium findings in different systems add up to full access, and that chaining is where most serious incidents actually come from.
- Assessment: broad coverage, prioritized backlog, no exploitation
- Assessment: good first look at an estate nobody has reviewed
- Test: narrow scope, exploitation, proof of real reachability
- Test: finds chained paths a scanner structurally cannot see
Which to buy first
If you have never looked, start with an assessment. Paying for proof that an attacker can get in, when you already know you have unpatched systems, buys a report you could have written yourself.
If you have a remediation programme running and want to know whether it is working, buy the test. The assessment will mostly tell you what your own tooling already told you.
Why the frameworks ask for both
Compliance frameworks that name these activities treat them as separate obligations, not alternatives. PCI DSS, for instance, requires vulnerability scanning and penetration testing in different sub-requirements, and a scan report does not satisfy the penetration testing requirement.
That is a useful tell. When a standard bothers to require both, it is because they answer different questions, and a vendor offering one as a substitute for the other is a vendor to decline.