Hire a decent IT person, have proper policies installed in the machines and forbid updates that were not vetted by IT. My company usually lags a quarter behind

Hire a decent IT person, have proper policies installed in the machines and forbid updates that were not vetted by IT. My company usually lags a quarter behind the latest OS, it about what it takes for it to pass certification. You're a company, your machines are tools for making money, treat them with the necessary care.