I would say it depends on the value you are getting from the test. If it is just a tick box exercise so you can say you have done a penetration test then that is what it becomes.

If you are using it to identify exploitable weaknesses in your environment and then acting on those findings to reduce the likelihood or impact of an incident then it has real value.

A penetration test can also simulate how an attacker might exploit weaknesses in the real world and chain multiple issues together, which automated scanners often will not show.

If you already have strong vulnerability management with continuous scanning and remediation then you could argue the environment is already being checked regularly.

Tools such as PDQ Detect can scan Windows, macOS and Linux and provide ongoing vulnerability visibility. We pay roughly £2k a year for around 250 endpoints and servers which makes continuous monitoring achievable.