A patch routine that sticks
The exploit that gets you is almost never a clever new one. It is a known bug, fixed months ago, on a box nobody patched. A dull routine beats that.
A cadence you will actually keep
Pick a regular window and patch on it — weekly for security updates is a sane default. Regularity is the point: a predictable small update is easy, a once-a-year marathon is terrifying and therefore postponed. We do our own maintenance in working hours for exactly this reason.
Stage it
Apply to a staging or canary box first, watch it, then roll to the rest. For a fleet, roll in waves so a bad update cannot take everything at once. Automate the routine ones with automatic updates and keep the judgement for the rest.
Know what needs a reboot, and handle the urgent one
A kernel or core library fix usually needs a reboot to take effect — a patched-but-not-rebooted box is still vulnerable. And some fixes cannot wait for the window: when an actively exploited bug lands, patch out of band. Keep remote KVM details handy so a reboot that goes wrong is recoverable.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base