You're mostly right, but along with working scanner people should hire an auditor to fix real bugs. Or it is just useless, spending a lot of money annually for

You're mostly right, but along with working scanner people should hire an auditor to fix real bugs. Or it is just useless, spending a lot of money annually for scanner forgetting about real vulns.