> No real company can do this. They can, but it requires automation. I've worked on and used tooling for just such things. We can see an upstream CVE and have

> No real company can do this. They can, but it requires automation. I've worked on and used tooling for just such things. We can see an upstream CVE and have it patched in production inside 48hrs. Usually the same day. Disclosure: I work for Pivotal. All this stuff (Cloud Foundry, BOSH etc) is opensource, but we sell commercial versions too.