A company runs several EC2 instances hosting a web application. The security team needs to understand who is responsible for patching the operating system and who is responsible for patching the underlying hypervisor as part of their compliance review. What is the correct division of responsibilities according to the AWS shared responsibility model?