For most of the interval the company was the victim of an incident that had already happened and had not yet surfaced.
Self-hosting transfers the patch obligation. In a window measured in days, that transfer decides the outcome.
Internet-facing, authentication-heavy, holding the files too sensitive for email. Managed file transfer keeps producing portfolios of victims.
The identity boundary expressed as hardware. And a vendor exploited recently is more likely, not less, to be exploited again.
A decision made years earlier for classification reasons turned out to be the security control.
The vendor did not tell customers to update the appliance. It told them to throw it away.
Ten years of telling people not to enable macros, and this one did not ask.