@vishybear wrote:However, I've seen enough times with Microsoft especially, but also VMWare back in the day where an entire infrastructure was taken down by a bad patch.
Here's a SUG (sweeping unsupported generalization): The patch tends to precede the exploit, often by months. This means that you don't have to be the first adopter of a patch, but you should be in that second wave or so (once the world hasn't collapsed).
SUG #2, the severity of some vulnerability or exposure often is only quantified after the exploit occurs. While we try our best, identifying the severity of a flaw is notoriously "not good." How often is the corporate line something like "it's highly unlikely" that a flaw could be exploited? Then, lo and behold, someone does it in a way that no one envisioned (often because it gets combined with just good old social engineering). By the same token, you also get the panicked headlines for vulnerabilities that likely will never be exploited. This is long way of saying, triaging patching (e.g., rush the "critical" ones) isn't reliable.
That said, a lot of this comes down to starting with your footprint. Keeping things simple makes patching simple. That's on both a personal level and an enterprise one, which today is one in the same because everyone uses personal devices (and habits) to access enterprise resources. Keep your systems up to date, but also keep those systems as lean as you can.
