The offense-defense logic about vulnerability closure may not apply in other domains outside cyber where the model of finite, patchable holes does not hold, limiting the generalizability of cyber automation insights to other security domains.