What happens when a vendor doesn’t patch its software?