Firewall software should be patched when vendors provide updates addressing:

1. A firewall is itself software that can be attacked. 2. Vendor updates exist for a specific reason. 3. Firewall software should be patched as vendors provide updates to address vulnerabilities. 4. So the answer is vulnerabilities. _Source: NIST SP 800-41 Rev. 1, 'Guidelines on Firewalls and Firewall Policy'_