Tools like Metasploit can often be destructive, not sure I would want to run them against production by default.. A more reasonable approach would be to set up

Tools like Metasploit can often be destructive, not sure I would want to run them against production by default.. A more reasonable approach would be to set up a lab when needed when one of the less invasive scanners flags a potential issue.