All software has security vulnerabilities, but organisations have vastly different attitudes toward fixing vulnerabilities as they are identified, and potentially different capabilities when it comes to fixing vulnerabilities in a timely manner.