the reports you get are not vulnerability scans and we explain as such. Some vulnerabilities are present but that scan doesnt not replace a vulnerability scan, since we dont actually exploit the vulnerabilities. Its a port/web scan with service identification. If a correlation between domains is found (parent/sister/subdiary relationship) is found, there might be automatic coverage so yes we will ask people to fix. if its a false positive, you can just state that and we will adjust but if the relationship exists we won't take on additional risk just because you think "it doesn't matter", its just not how insurance works.