is remediation of vulnerabilities in public infrastructure significantly bottlenecked on discovering/patching those vulnerabilities? (my understanding is the biggest constraints are local resources and regulatory controls, but this is certainly not my area of expertise)
