Vulnerability assessment is the process of discovering and analysing vulnerabilities and penetration testing is the process of exploiting those vulnerabilities to help determine the best mitigation technique.