Well, let's say that you have 2 physical locations, 10 racks each, and a cloud provider, the OS, the networking equipment, the smart PDUs, the iDRAC and firmware, kernel (reboot), containers, VMware hosts/vsphere, Openshift, a few windows boxes because why not, database, apache, and all the downstream. A "high" CVE has 3 weeks to be fixed.