PCI DSS separates vulnerability scanning from penetration testing. DORA requires digital operational resilience testing and, ...