"Even when security teams have full visibility of their domains there are often systems that can’t be patched or updated... CNI providers have to think in terms of decades for their security and operations"