[ontoillogical]

<self promotion>

I'm not surprised to see that the first thing you listed was patching known vulnerabilities. Staying up to date with known vulnerabilities is the baseline of a security policy, but patch management is needlessly hard, especially if you don't have dedicated staff to scour security mailinglists.

We built a product to make this easier: https://appcanary.com . Maybe it would have helped your old employer.

</self promotion>