Security patches are not a plan, only part of one