This is so ludicrous as to render me sterile. Zero-day bug with a 348 day lifespan? Most IT managers are woefully ignorant of even the most basic security elements let alone how long they've lived with a vulnerability. Patching ONLY addresses KNOWN system flaws. It DOES NOT address unknown issues nor the threat conditions that can actually cause harm. So much of the industry banter is focused on patching that people have lost focus on the true source of problems: threats. A fully-patched a properly configured network is still at-risk from abuse, data leakage, errors and malicious activity. People just have to know what is happening. Unfortunately, the complexity of most tools makes even a basic understanding difficult and expensive at the very least.