Where patching is hard or cannot be sped up, strengthen defence in depth with virtual patching (for example cloud WAFs) and bot mitigation, and against lateral movement with network segmentation, MFA for privileged accounts and detection such as EDR; since these only reduce risk, assess residual risk and follow risk acceptance procedures reflecting the time to patch.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.