Comment by andrewaylett

There are vendors who supply this service as a product -- Wiz, who were one of the groups to independently discover the vulnerability, is one such vendor, there are plenty of others.

I'm not overly keen on the tooling: as far as I can tell the whole industry is prone to flagging false positives as "vulnerabilities" rather than "potential vulnerabilities" and it's a bit too easy to turn those reports into a tick-box "you must update now because the tool says so". But they also do flag true vulnerabilities. And they pay for teams of security researchers to find and fix issues, not least because that's good marketing.