I don't understand why people keep bringing Microsoft into this. This testing is the responsibility of the company whose computer fleet it is. They have many u

I don't understand why people keep bringing Microsoft into this. This testing is the responsibility of the company whose computer fleet it is. They have many upstream software vendors - often 10s or 100s - and should be doing this testing every time. You should never rely on the vendor to test (evidently). I'd go so far as to assume all vendor updates are hostile and build your test model against that. Automated testing of new software in companies with 10k+ desktops (which covers most affected companies here) should be as common as password policies or email attachment policies. If the vendor implements things in a way that doesn't allow this style of testing, they don't meet security requirements and another should be found.