We got the scan vendor
Our CC processing company told us to use a particular vendor for scans. They have a deal with them, and feed their customers. The security vendor will scan for free, and support you through the process of the SAQ, but they have an ulterior motive.
They want to sell consulting services. And they get to judge if my company is PCI compliant. So any mistep means they can declare us not compliant, and then come in to sell their services. This is a major conflict of interest.
On the other hand, we are tiny, single computer room, 3 servers internally and an external hosted website. They know they can't make any real money from us, so they are usually very helpful by default. They just want us off their plate.
Our new web site passed the scan yesterday and we can put their logo on it. Yay!
