This is how I feel. If you're blindly installing software system wide, that has kernel access no less, and not accounting for failure of that software in your

This is how I feel. If you're blindly installing software system wide, that has kernel access no less, and not accounting for failure of that software in your risk analysis then you are to blame more so than the vendor. Certainly I expect some SLA is in place but that's only of monetary benefit and irrelevant to keeping critical infra online.