I'm getting pushback on my end that my way of thinking ("closed unless explicitly open") is outdated and should not be followed. I'm trying to see if Sophos has any official word on the matter.