However for your patches and what not, go with something like Nessus. However, it depends on the rules that the hosting provider allows, and you'll probably still want to let them know a head of time, and get a get out of jail free card.
The site has been hacked 3 times in 4 years (they changed the sites default language to swedish once) and I know from the logs that it's not the php app that we're using or that they brute forced the passwords (26 character pass-phrase) but the SQL on the machine was a much older version and not patched fully.
Have had quite a disussion with their tech and sales guys about this and was thinking about doing a discreete white & black test to give me some ammo to light a fire up their asses