For Linux devices, you'd tell employees to only install software through their package manager, then have something like unattended-upgrades (installed by defau

For Linux devices, you'd tell employees to only install software through their package manager, then have something like unattended-upgrades (installed by default on Debian-based systems) handle automatic security updates. https://wiki.debian.org/UnattendedUpgrades https://wiki.debian.org/UnattendedUpgrades