I admit I don't know a lot about these systems, but aren't they trying to solve a different problem? Aren't they trying to solve visibility? Once you know a vu

I admit I don't know a lot about these systems, but aren't they trying to solve a different problem? Aren't they trying to solve visibility? Once you know a vulnerability exists in a particular version of a particular piece of software, you need a way to go from there, through dependencies, to builds, and then to deployments. You can't push fixes to all the right places without knowing what those places are. In other words, you need to correctly and completely answer questions like, "Oh, CVE-YYYY-NNNNN was just announced. What's the list of every binary on every machine of every platform we have in every environment (production, corporate network, employee cell phones) that needs a fix?" You can do it manually, but that's basically asking for failure because you'll miss things. Also it's tedious.