In conversations about operating system security, “compliance” tends to dominate. But for those of us responsible for keeping infrastructure secure—whether facing STIG implementations, CIS benchmark requirements, or FedRAMP assessments—we know the truth: ...