Comment by bcassedy

That same management is the type to set rules where you don't get to assess if you're vulnerable, you just have to fix all the CVEs