There is no question that vulnerability scanning and patch management remain necessary, but they are clearly no longer sufficient ...