Configuration management security applies universally - commercial software has default settings that must be secured, custom-built applications need proper configuration, and in-house applications require the same security rigor. Security through proper configuration is vendor-agnostic.