Exactly, if you've got a complex environment, you might not even know that one of your suppliers deployed an insecure ruby gem (or any other package), but you'l

Exactly, if you've got a complex environment, you might not even know that one of your suppliers deployed an insecure ruby gem (or any other package), but you'll want to do full testing before upgrading. All this leaves big windows of opportunity for attacks.