$boss has decreed that's it's too great a risk to have a newly imaged PC on our internal network while it gets security software and patches, and thus all new unpatched PCs must first raw dog the internet to be set up before connecting behind the IPS for compliance.