I mean, plenty of human pen-testers also use automated tools. It's common knowledge (or at least I thought it was) that these scanners produce contextless outpu

I mean, plenty of human pen-testers also use automated tools. It's common knowledge (or at least I thought it was) that these scanners produce contextless output that is going to require analysis in order to be useful. The scanner is just looking for known vulnerabilities; that's a useful tool, because you don't necessarily need to know that a CVE was published to know that it exists in your environment. A human still needs to step in and match that finding to a real risk of exploitation.