Patching shouldn't be the action item teams get to when other higher-priority tasks are completed. It's core to keeping a business alive.

Training and development should be a non-negotiable element in developing an effective approach to risk management.