Justifying the spend on a vulnerability scanner

[JM <jamesmcgeeiom () onetel net uk>]

As the subject says, this is what I have got to do.

I could dream up loads of examples of; 
if we dont detect a code read virus and we get it, then it 
will knock out our webservers and others until we fix it.
if we have open null shares on the network, and unrestricted 
access to remote registries people can do what they 
want.......

But does anyone have any thoughts to share, on how I can 
successfully convince my management that the spend on a 
vulnerability scanner is worthwhile.

Thanks in advance

JM