readme

vulnerability-reporting-vms/README.md

@@ -33,6 +33,8 @@ Before craeting a VM, we must ensure that these azure resources also exist. They
 
 One VM will be created for every vhd-publishing-info.json file passed.
 
+In order for the VMs to run AzSecPack they need to be tagged with `SkipLinuxAzSecPack: false` (todo alburgess need to confirm this)
+
 ## ADO pipeline
 
 While it is possible to run the go code locally, the intended use case is for it to run after the build / e2e tests in our *AKS Linux VHD Build* pipeline. After the build step completes, vhd-publishing-info.json files are published in two seperate artifacts