Network updates are an amazing trainwreck. No matter how elegant you seem to be, you'll always be running like half a dozen versions in the wild. For any larg

Network updates are an amazing trainwreck. No matter how elegant you seem to be, you'll always be running like half a dozen versions in the wild. For any large deployment that kind of work will be on your shoulders anyways. Stuffing in security updates or whatever to that isn't crazy Unless you're saying you want multichannel overlapping upgrade schedules where you have some NxM cadence matrix to test and support (as in ssh x+/-{1,2,3} AND your software x+/-{1,2,3} etc). I've had to make and manage automated test rigs for those types of deployment as well. That's an entire room full of whatever machines your deploying and a full time job. Anyways, this stuff is hard for the out in the wild devices. Putting security updates in a monolithic release package is really the easier way to go and at that point it's on you.