It's less blind than other places I have worked. When a CVE is announced, we know immediately if we are impacted and what will need to be fixed. Some places h

It's less blind than other places I have worked. When a CVE is announced, we know immediately if we are impacted and what will need to be fixed. Some places have no idea what their dependencies are. I am sure there are lots of log4j horror stories from Java shops that were not so careful.