[adricnet]

Yes, especially when they seem to affect their applications.

Automatic updates are easy (mostly). Healthy software and vulnerability management that doesn't damage productivity needlessly can be a lot of work. What do you test?

The classic simplified use case for this is Java runtimes: Your organization needs: a) A specific Java version to run a critical application b) Not to have workstations compromised though weak Java versions.

As a technology and security professional in this space your objective is to meet both of these goals. As the application developer you may have totally different goals (release date, market share, sales, renewals) and may not have these on your map at all...