Which two risks is a company vulnerable to if it does not have a well-established patching solution for endpoints? (Choose two.)