Assume the breach. Zero-days keep shipping, AI is writing exploits faster than anyone patches, and « patch everything in time » stopped working years ago. Stop betting the org on winning that race. You don’t control which bug lands. You control what it can reach once it does.
That is a question about the shape of your network, and most teams have the shape wrong. HD Moore, creator of Metasploit