of course there's a third option, one that small businesses are opting for en masse: pay for a well-known 3rd party to run a simple remote vulnerability scan, p

of course there's a third option, one that small businesses are opting for en masse: pay for a well-known 3rd party to run a simple remote vulnerability scan, pass the results (full of false positives and just plain wrong information) to someone else to deal with, and pretend like you just accomplished something useful, and reject all recommendations for anything that costs more.