The alliance argued that, while these vendors and their peers work hard to make their products as secure as possible, end-customer patching and vulnerability management is often sub-par.