I ask every enterprise I walk into what the patch management strategy is. There's always herds of testing, that often takes months. Recommendation? Patch first,

I ask every enterprise I walk into what the patch management strategy is. There's always herds of testing, that often takes months. Recommendation? Patch first, deal with compatibility later. In most cases (note, not all) being hacked is more expensive than a temporary, self-imposed denial of service. Edit: Thing I forgot to add is that an aggressive patch management strategy just so happens to do great things for technical debt.