Correctly patched, correctly configured, reporting green, and serving an attacker. Patch coverage cannot see the difference.