I think it&#x27;s time to encode in law security requirements, a minimum timespan for security patches to be provided post purchase, a maximum timeframe for security patch provision, and liability for unpatched security holes.