Can Vulnerability Scanning Replace Penetration Testing?