> the MVP is trying to start with a better inventory of everything That's a logical place to start and it definitely seems like a common weak point. It's also

> the MVP is trying to start with a better inventory of everything That's a logical place to start and it definitely seems like a common weak point. It's also hard to justify spending in this area since it's not emphasized in compliance and it's hard to explain why it's important in a blurb. > Do you have a reliable ... inventory As you allude to, it seems pretty common to have multiple existing inventory sources and no way to integrate them. To me, the most intractable part of the problem was, ironically, workstations and servers. They are managed by different people using different tools and neither of these groups want additional security agents on their systems. Also, these types of agents tend to be prohibitively expensive when you have thousands of endpoints. > systems themselves decide to mitigate issues, propagate patches This seems problematic. I really don't want the security system breaking things without staff intervention. Security already gets blamed for any unexplained problems that desktop, servers, networking, and development have.