egg and hammer vulnerability scan vs penetration testing