It's time to turn from CVSS-backed patching to choke-point patching focused on breaking chains to critical assets.