As there were no reports of this vulnerability being exploited in the wild, we did not prompt our users to install this update I don't think that qualifies as

As there were no reports of this vulnerability being exploited in the wild, we did not prompt our users to install this update I don't think that qualifies as logical risk management. To me, it's like saying, "I haven't been in a car wreck so far, so I wont use my seat belt".