No capability and very limited tooling in a lot of cases. For example the Log4J vulnerability is virtually impossible to confidently identify and resolve because we do not have a CMDB with soft assets recorded.