Reading through the timeline, it shows that at every step Equifax was trying to do the right thing...internally publishing vulnerabilities, applying patches, sc

Reading through the timeline, it shows that at every step Equifax was trying to do the right thing...internally publishing vulnerabilities, applying patches, scanning for vulnerabilities, etc. The policies and procedures were good. One difference is that previously Equifax claimed a single employee failed to scan and patch a system. I don't see a reference to that in the report. All I see now is that someone scanned a system improperly: > The scan did not identify any components utilizing an affected version of Apache Struts. Interim CSO Russ Ayres stated the scan missed identifying the vulnerability because the scan was run on the root directory, not the subdirectory where the Apache Struts was listed.