Both vulnerability assessments and penetration tests are necessary to build Cyber Resilience in an enterprise, and you should include both as part of your security program.  However, most organizations aren't receiving penetration tests that fill the need of simulating a cyber attack which actually tests the defenses in place and their overall security posture.