Many of the agencies we reviewed didnt even know what applications and  platforms were operating on their systems. That begs the question -- how can you protect something if you dont even know what you need to protect?