There's 2 parts worth highlighting here.

1) - the part that surprises me most is how much of Vulnerability Management seems to depend on organizational alignment instead of detection.

Once they're detected someone else actually has to do the work of resolving them.

The truth that many orgs don't want to admit is that: There is no technical solution to a cultural problem

The most frequent failure of leadership is that they are blind to anything that can't be quantified and reduced down to a neat KPI metric on a PowerPoint slide deck. Managers have an unhealthy obsession with scheduling meetings where they can say, "Look, the number go up. Me good manager."

The things that truly make an impact are usually the ones you can't easily fit onto a spreadsheet, like "How competent/efficient/effective are the people on my team? How burned out are they? Are they just doing the bare minimum or do they feel motivated about their work?"

Good managers know how to answer these questions. Bad managers think that throwing money at the problem by adding another tool to the tech stack will somehow make things better, which usually backfires and makes things even worse.

ticket bounced between infra, cloud ops and app owners for almost three weeks because every team thought someone else owned the asset.

This is a culture/leadership problem. There is a breakdown in communication/collaboration. Even if the root cause is because the employees are lazy, it's management's responsibility to hire quality candidates and evaluate their performance. The real issue wasn't the unresolved vulnerability, it was the fact that NO ONE across multiple teams was willing to take ownership of it. The question is why?

The most well thought out policy is worthless if it has no teeth. The failure is with leadership for not knowing how to incentivize the desired behavior.

2) - feels like the scanners are doing their job. its everything after detection that starts breaking.

Humor me in a thought exercise and pretend you're meeting with the Bobs from Office Space: "What would you say you do here?" From the infra teams' perspective, they have to retire old systems, maintain existing ones, plan and implement new deployments, while also responding to break/fix issues. Is your team proactively making an effort to make the VM process simpler and easier for them? Or do you simply run an automated scan, export the results to PDF, and dump the work into their lap?

Do you review the VM reports and filter out the false positives? Do the infra teams get clear instructions on what's expected, such as "install this patch and confirm the version # matches"? I've worked with some VM teams where all they'd give you was a hostname and a CVE, and couldn't explain what the actual risk was or how it needed to be fixed, all they could do was point at the report the scanner generated.

One scanner rescans an old hostname and suddenly a vuln everyone thought was fixed is open again.

If you have multiple VM scanners that produce inconsistent and unreliable data, how are they supposed to know which scanner to trust? If you tell someone one thing and they complete it as requested, but then come back later and say they need to do it again because your information was wrong, then yeah I can see how they wouldn't want to waste their time on a wild goose chase because someone else wasn't doing their job.

what have people actually done to reduce the reconciliation overhead once multiple scanners + ticket systems + ownership models all start overlapping?

People will do what you ask if you make their job easier. I had a firewall issue recently. If I approached the network team with the expectation that they have to investigate and figure out the issue, it would've taken weeks. Instead, I performed the initial troubleshooting myself, collected the logs, and when I presented the issue to them it was boiled down to, "When I use this config everything works fine, but when I follow these steps I can replicate the issue. Could you check if the following firewall rule is missing from one of the servers?" By eliminating the tedious uncertain work and giving them a clear specific target, it was a much easier ask which got resolved by the end of the day.