All services are dockerized, updated nightly.

Server OS runs a kernel-patch service for real time exploit patching.

All other updates as soon as they appear.

Yeah, sometimes I'll need to go in a repair - but that's way better than having to clean up after having been exploited due to not keeping up on security patches.