What are you on about? Your first point is that known vulnerabilities are the main issue, but somehow scanning for known issue won't help?

Additionally, I hate this "If it doesn't fix every issue, it's not worth doing" argument