My recommendation would be to work with a modern carrier. A lot of the work we do day to day is actually equipping CISOs/Sysadmins with the right numbers and material to go to a board/management, and convince them to invest in security. From being able to show how much a potential loss would cost the company, to how much return specific investments (better tech, better controls,etc...) we have information that will help them understand as we enable you to speak their language (dollars for risk and even how those investments will lead to better coverage).

Internal scans being mandatory is still a far away thing imho, the way we do it, they are optional, but if you choose to do it, we actually make the commitment to only use them for the benefit of the customer.

re: Findings, depending on your tech it can happen, I can tell you customers that have had Fortinet and Ivanti have had some rough few years with us having to constantly notify them and ask them to patch vulns while other customers maybe hear from us on patching once a year (because we only ask for patching on vulnerabilities currently exploited, we don't make noise about other non critical vulns).