In the last few years we used to do windows updates quarterly on our production servers as required by PCI DSS. In the last year though, we’ve had to do updates every single month due to critical CVEs needing to be patched. It’s becoming ludicrous actually, yet they’re cutting security folk.