Vulnerability scanning and penetration testing aid in the cyber risk analysis process and help to determine controls best suited for the business.