Just a consideration, 80% of system vulnerabilities are due to misconfigurations ... no blame on system admins then :)
about patching vulnerabilities
http://dotnetjunkies.com/WebLog/stefandemetz/archive/2004/05/07/13102.aspx
http://dotnetjunkies.com/WebLog/stefandemetz/archive/2004/05/11/13358.aspx