I play defense. The system owners I work with have to manage many systems with complies relationships. They keep a list, and report to management that they have

I play defense. The system owners I work with have to manage many systems with complies relationships. They keep a list, and report to management that they have patched, say 98% of machines against the latest vulnerability. Great! The remaining 2% include the KDC, the build system, and the default shell servers for dev and ops. To catch this slip-up, I have to understand the dependencies that even the supervising managers don't. And I have to be able to explain such to management. Every time. I sympathize greatly with the point the author's making. Like him, I don't have a fix in mind.