Vulnerability scans are only a part of the equation. Vulnerability Management programs acknowledge this, but many organizations still use vulnerability scans unsuccessfully, or refuse to look beyond them out of fear of failure. This will be a short and hopefully light-hearted presentation that attempts to explore some of the common failures of vulnerability scanning as part of vulnerability management programs from a penetration tester's point of view. Let's get some practical advice about using vulnerability scans and penetration testing effectively to round out the security program above and beyond compliance and controls requirements.