You Bought a Scanner. Who Owns the Fixes? The Part of VMaaS Nobody Puts on the Pricing Page

A vulnerability scanner can identify weaknesses. It cannot, by itself, get a system owner to approve a patch window, document an exception, or confirm that a fix worked.

That work takes people, process, and sustained ownership. It is the part of vulnerability management that can disappear from view when you compare solutions by scanner features or license cost alone.

So before you build a program around a tool, or buy vulnerability management as a service (VMaaS), ask the more useful question: Who owns getting the findings closed?

THE REAL COST OF BUILDING VULNERABILITY MANAGEMENT

Building in-house may be the right choice for some organizations. But the tool is only one line in the effort required to run a dependable program.

1. A scanner license, and an environment to scan

Enterprise vulnerability scanners come with real licensing and maintenance costs. You also need a reliable source of asset information: without an inventory of servers, endpoints, cloud workloads, and internet-facing systems, you cannot tell whether scans cover the environment you intend to protect.

An inventory cannot be treated as a one-time spreadsheet. Assets change. Systems move, new services appear, and old devices can remain connected after their owners have moved on. Discovery and inventory reconciliation need ongoing attention.

2. Someone who knows how to configure and interpret scans

A scan’s value depends on how it is run and what happens to its results. Internal credentialed scans use authorized access to inspect systems more thoroughly. Uncredentialed scans provide an outside-in view of what may be visible without those permissions. A sound program considers both where appropriate, and documents where authentication or coverage is missing.

Someone must also select safe checks, schedule scans without disrupting operations, troubleshoot failed assessments, and review findings. Automated tools can report likely weaknesses, but their output may need context and validation before it becomes work for an IT team.

Without that review, false positives and duplicate findings consume analyst time. Worse, they weaken trust in the whole report: system owners who repeatedly chase findings that do not apply may be less responsive when a serious one appears.

3. A person accountable for remediation follow-through

This is the ownership gap many build-versus-buy comparisons understate.

Someone must contact system owners, explain why findings matter, negotiate patch windows, track tickets, follow up on blockers, document exceptions, and confirm closure. If a system cannot be patched, the work does not simply end. The organization still needs to understand and document the risk, consider mitigations, assign an accountable decision-maker, and revisit the exception.

A scanner without that follow-through can produce a weekly report that nobody has time to read. Findings accumulate; responsibility stays vague.

The operational cost is not just finding vulnerabilities. It is repeatedly turning them into assigned, completed, and verified work.

4. Knowledge that stays with the program

A program can depend heavily on one experienced analyst who knows which findings are meaningful, who owns which systems, and how to handle recurring exceptions. If that person leaves, the scanner may still run, but the knowledge behind the process can leave with them.

That dependency is a real build cost. It belongs in the conversation alongside licenses, integrations, staff time, and ongoing maintenance.

WHAT THE PATCHING FIGURES DO, AND DON’T, TELL YOU

The Verizon 2026 Data Breach Investigations Report (DBIR) has been reported as finding a 43-day median time to fully resolve critical vulnerabilities. That is a median for the report’s observed data, not a promise that every organization takes 43 days, and not a measure of how long every patch should take.

The frequently cited 26% KEV remediation rate also needs context. It refers to observed critical vulnerabilities included in the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities (KEV) Catalog that were fully remediated in the analysis, not 26% of organizations meeting a remediation target. The public reporting available for this figure does not make every denominator and calculation easy to independently reproduce. Treat it as an indicator of a documented remediation gap, not a universal rate for all businesses.

These figures do not prove that every team is understaffed, or that a managed service automatically fixes the problem. They do show why detection alone is not enough: even known, exploited weaknesses can remain open while teams deal with competing work.

WHAT A MANAGED VMAAS SHOULD INCLUDE

Buying VMaaS should mean buying an operational process, not simply access to another scanner. Use these criteria to evaluate what a provider actually delivers:

• Continuous discovery: A current view of assets, including new and changing systems, not just a list from an occasional scan.
• Credentialed scanning: Authenticated coverage where safe and feasible, alongside external scans, with visibility into scan failures and gaps.
• Risk-based prioritization: Findings prioritized using factors such as exploit probability (EPSS), KEV status, exposure, and business context, not CVSS severity alone.
• Guided remediation with named owners: Actionable findings tied to responsible teams, target dates, tickets, blockers, and a documented exception path.
• Fix validation: Rescans or other checks to confirm that remediation actually closed the finding.
• Audit-ready evidence: Records of findings, decisions, actions, exceptions, and verified closure.
• Leadership-ready reporting: Clear summaries of material risk, overdue work, remediation progress, and trends, not just a raw scan export.

Be precise about responsibility. A managed provider can discover, prioritize, guide, coordinate, track, and validate remediation. Your organization still owns its assets, approves operational changes, assigns internal system owners, and makes risk-acceptance decisions. VMaaS should make those responsibilities easier to carry out, not obscure who has them.

Cenova Cyber’s VMaaS is designed to connect asset discovery and scanning with risk-based prioritization, remediation coordination, validation, and reporting. The service is intended to extend your team’s capacity, not replace your internal decision-makers.

QUESTIONS TO ASK ANY VMAAS PROVIDER

Ask for concrete answers, not just a feature list:

1. How do you handle assets that cannot be patched? Ask how exceptions are documented, mitigations are considered, and decisions are revisited.
2. What is your false-positive process? Find out who validates findings and how you can review the evidence and disposition.
3. Who communicates with my system owners? Confirm whether the provider coordinates follow-up or simply sends your team a report.
4. What does your remediation SLA cover? Separate the provider’s response and coordination commitments from the time your own teams need to implement a fix.
5. What evidence will I receive for auditors? Ask to see examples of remediation tracking, validation, and exception records.

A strong answer makes the workflow understandable: who does what, when, and how you will know the issue is closed.

BUILD, BUY, OR SHARE THE WORK?

Build when you have the expertise and staffing to own the full program, including tool administration, scan review, remediation coordination, and continuity if key people leave. It can make sense when requirements are specialized and your team can sustain the work over time.

Buy VMaaS when you need those capabilities but do not have a dedicated vulnerability team. The service can bring together tools, expertise, and follow-through without requiring you to assemble every function internally. Evaluate the provider on the lifecycle it supports, not the number of dashboards it offers.

Share the work by keeping internal authority over asset ownership, patch approval, and risk decisions while using a provider for discovery, prioritization, coordination, and validation. For many organizations, this is the practical middle ground: internal teams retain control while gaining help with the work that is hardest to keep moving.

BUY THE FOLLOW-THROUGH, NOT JUST THE SCANNER

A scanner can show you where exposure exists. A vulnerability management program gives findings owners, clear next steps, documented decisions, and verified closure.

If your team does not have a dedicated vulnerability function, include the human work in your decision, not as an afterthought, but as part of the solution you are evaluating.

Book a free consultation with Cenova Cyber to discuss your current scanning process, remediation ownership, and whether VMaaS fits your needs. Learn more about Cenova Cyber VMaaS or schedule a conversation.