I think your list of steps is flawed.
It looks more like this (source):
- Planning & Preparation
- Analyzing information and risks
- Active intrusion attempts
- Final analysis
- Report preparation
Performing a scan on an application is not a penetration test. It is just that, a vulnerability scan.
It's very unlikely that you don't see any vulnerabilities. Usually you make a pentest for a reason.
There are endless potential attack vectors that a scanner cannot detect. The first thing that comes to my mind are business logic flaws. Also scanners (without complicated manual setup) are not very good at detecting authentication flaws like IDOR. Something a good human pentester will find after the first few minutes of their assessment.
A simple example is the integration of payment providers. I've often seen flaws in the implementation where you could just re-send a specific request in the payment-process, to order the same item over and over again without paying for it. Or you could modify the payment amount. I've even seen webshops where you could recharge gift cards by manually setting the item price to a negative amount. How should a scanner test for that, when it involves third-party components?
Nothing can replace a human pentester.
So the concrete answer to your question is: you analyze all requests and business logic manually, if you couldn't find anything during your automated vulnerability assessment.