This model represents the cyber security environment of vulnerabilities and exploits to be mitigated through vendor patches AND the organisation capability to apply them.