Assessed continuously from the binaries actually present on disk across the servers Mimic monitors — not from self-reported inventory. This is how far real-world patching lags the public CVE record, and how concentrated the urgent part of it really is.