If you’re the one who gets CVE alerts and has to convince others to take them seriously, this whitepaper might help. It has some with stats and positioning that can support your case for prioritizing vulnerability management.
Yeah, there’s a bit about how #Perforce #Puppet can help at the end, but there are good business case things on MTTR and breach risks too. Some links in there to some supporting reports from other sources, as well.
https://www.puppet.com/resources/vulnerability-management-business-value