Comment by dozzie

Analysis is easier because you already have a running agent that you can remotely query about deployed software. With regular OS you need to provide such an agent.

I don't know why it's easier to mitigate risks, though. Maybe just because it's easier to run the analysis.