Businesses only care about security fixes as far as compliance and a reasonable level risk. It’s more important to them type be able to tell auditors that they

Businesses only care about security fixes as far as compliance and a reasonable level risk. It’s more important to them type be able to tell auditors that they are following a mitigation process. In my case that means all I’m doing is pulling Amazon Linux images and running automatic security updates. Using Amazon Linux is the path of least resistance because it comes with AWS tooling and it’s already optimized for AWS. Everything else is basically “who cares?”