Security Think Tank: Patching is vital and essentially a risk management exercise