When tasked with securing an application there is a choice between an automated vulnerability scan and a pentest. When starting out, companies will often focus on automated testing/scanning procedures rather than manual in-depth application reviews.