That's one thing the org I work for does right. We do have monthly tests, scans, and network BGP issues. And our governmental side has a different set of scans

That's one thing the org I work for does right. We do have monthly tests, scans, and network BGP issues. And our governmental side has a different set of scans, which also include system security scans. Whomever the oncall is, ends up doing them during the week. It's usually pretty quick, but can turn into a slog. Oh, and all our machines are updated appropriately, not just the border machines. There are some services we're not able to adequately update, like FreeRadius - but for each of those we review the criticality and determine if we need the resources to make it work (aka: remote priv exploit)