Now I know that Core Impact is a really cool tool, though I've not had a chance to play with it directly, but it's not always the right tool for the job.... Like in this case, we have a network manager who's using this as what looks like a vulnerability management tool and even saying you can give it to a junior engineer to use... D'oh!
Surely the best way as a network manager to do this is through patch management or vuln. scanning tools which you run regularly over your whole estate, not through pointing a Penetration testing tool at some servers...
No matter how many exploits Core have for their product they're never going to find as many holes as a tool that authenticates to the box and enumerates missing patches and security policy non-compliances..
Apart from anything else actually exploiting vulnerable services always runs a risk of crashing the service or indeed the server, which a patch scanning/security config scanning tool wouldn't.
The really bizarre part is that core actually use this as a case study on their site...
