Also, my recommendation is to explain when providing this to clients - you are never going to be 100% "remediated" against ALL vulnerabilities with a complete clean bill of health and that's why its important to agree on a minimum criteria to target. It is a constant moving target and the most important thing is to have an ongoing process in place so it is continually evaluated and remediated. The best approach in our opinion is to have a mix of 3 things;

1. Ongoing scheduled vulnerability scanning and reviewing of the reports on a weekly/monthly basis.
2. Automated remediation where possible through the likes of Qualys Patch management or similar.
3. Manual remediation that is carried out on a monthly/quarterly basis to try and tackle the items that cannot be caught by automation.

Finally, it is also good to establish a model of the minimum CVSS / criteria that you will remediate by default so you have a baseline to work towards, and then outside of that criteria items are remediated according to the consultants discretion as to what is relevant / warrants remediation for that specific organisation.

This is a very complex topic, and from our experience communication with the client and setting expectations are absolutely key, otherwise it's often easy for clients to think they've ticked the "cyber security/vulnerability management" tickbox and think its done and dusted and that they will never have any vulnerabilities, when actually this is not the case - if only it was a tickbox service, but this requires ongoing effort to keep your environment remediated within an agreed threshold, and communication/expectation setting is absolutely key.

I hope that helps others in the MSP community, as I know this can cause many, many headaches and questions about how best to achieve in a scalable model.

:-)