I've used it at a couple places. It's pretty good. It's best at checking the box on an audit to say you have a vulnerability management program.

If you want real coverage, you should also be actively involved in what's in your company's environment, and how security updates (for external software) and vulnerabilities (for internal) are handled. That is, do you have people looking for vulnerabilities, e.g. with fuzzing?

For Windows environments, you should additionally look at bloodhound and pingcastle.