1. How has the way in which decisions about security were made change with the new approach? What are the key differences? What are the most likely effects of the new procedures?

2. Should companies always patch and fix all systems immediately? Why would they take the risk of not doing so? Can you think of any other examples beyond those presented in the case?

Should companies immediately patch their systems?