Understanding the differences between vulnerability assessments / management and penetration tests – when is each appropriate, and where do you need both; and how do these support compliance and cyber insurance requirements.