Exactly. A lot of times the vulnerability exists in something you’re not using, but it still shows up in reports. Sifting through that and writing up why that

Exactly. A lot of times the vulnerability exists in something you’re not using, but it still shows up in reports. Sifting through that and writing up why that vulnerability doesn’t actually apply to your environment and showing evidence of such is an incredibly time consuming process. It’s honestly easier to just patch it, a lot of times.