How to Detect a Vulnerable System?

Most scanners were based on version number, and they didn't have the context of whether or not you were mitigated. You remove the jdn i class, you could disable look ups in the configuration file. But do you want to take that chance when you have everybody and their dog running around trying to stuff ran somewhere through this vulnerability? That's the conundrum we have.