Thoughts on Cyber security vulnerability scans?

So there should be internal and external parties scanning your systems and the company should be moving between vulnerability assessments, penetration testing and red team assessments. You start with vulnerability assessments to fix all of the low hanging fruit. When you think you are good to go or you just need a wide understanding of how bad it is right now you can bring in a penetration testing team. Never use someone that is not actually paid to do this as the people doing the penetration test as it needs to be down by a professional human penetration testing team not someone just learning with no experience conducting offensive operations against information systems. Their goal is to show you how bad it is and find as many vulnerabilities possible that your company has missed, half fixed, misconfigurations, etc. Then when they have done their thing you bring in the red team to break through your new shiny setup to validate acting as an actual adversary to determine the actual security of your systems and networks. There should be continuous vulnerability scans in chunks across all your systems and networks going on that are unauthenticated and authenticated across all your systems where possible to provide continuous understanding of your current state. There should also be SBOMs and HBOMs being send very regularly as in hourly to be processed to show everything on your systems to allow for thorough deep dependency understanding. Mirror that with a production grade SIEM that enables you to see it all, be alerted, and enable monitoring, etc. and you are in a good place. This would allow you to see how really bad things are now and the improvements or regressions over time.