"Are we patched?" is a comforting question with a useless answer.
Patched is binary, which is exactly why people like asking it. Yes or no, tick or cross, something for the board pack. The trouble is that "yes, we're patched" describes a moment that has already passed, against a list of flaws someone has already published.
The thing that actually hurts you is the gap. The window between a vulnerability becoming known and your estate actually closing it. On the most exposed systems that window needs to be short. On systems that can't be touched without an outage, it might be long, and the honest answer is a compensating control, not a patch.
So vulnerability management isn't a patching project with a finish line. It's a continuous reckoning with exposure: what's reachable, what's exploitable today, what would genuinely hurt if it went, and what you do about the things you can't simply update.
"Are we patched" treats security as a state you arrive at. It isn't. It's a rate. How fast you find what's exposed, and how fast you close it, against an attacker working the same published list.
The better board question is not whether we're patched. It's how long we stay exposed once we know.