It is worth mentioning that automated methods are much faster in performing the security analysis.
Alavi, Bessler and Massoth 2018
The preceding remark by Alavi, Bessler and Massoth describes the decisive motive behind the use of vulnerability scanners when performing penetration tests: while both have the identification of vulnerabilities in IT systems as their main task, vulnerability scanners do this purely automated and merely need to be configured and started by a user. Because of the smaller amount of personnel involved, customers purchasing a pentest should be careful not to be "fobbed off" with a dressed-up vulnerability scan report.
How well the results of a vulnerability scanner can be compared with a penetration test was demonstrated by two BACPP students - Saed Alavi and Niklas Bessler - in their paper "A Comparative Evaluation of Automated Vulnerability Scans Versus Manual Penetration Tests on False-negative Errors". For their analysis, they asked themselves how many vulnerabilities are not identified as such by a vulnerability scanner and by a penetration tester even though the flaws are present. In academic jargon, this is referred to as the false-negative rate (FNR). To this end, they built an IT infrastructure riddled with vulnerabilities and subjected it to both a penetration test and a vulnerability scan. As - admittedly - was to be expected, they concluded that penetration tests can include vulnerability scans but, with their manual testing phases, go far beyond them:
"Most importantly, we have seen a remarkable higher false-negative rate in the vulnerability scan, which suggests that automated methods cannot replace manual penetration testing. However, the combination of both methods is a conceivable approach."
Alavi, Bessler and Massoth 2018
Nevertheless, the use of vulnerability scanners is not obsolete: even though the wealth of information a vulnerability scanner produces first has to be surveyed, sorted and evaluated - depending on the scanner, this may unfortunately require even an expert - they are a tool for hardening your own IT.