Default settings, vendor deployments and aging configurations can leave exploitable vulnerabilities in place long after systems appear to be working normally.