If we asked a new client what they had in place for patching most of them would answer in one of two ways. Either they’re “pretty sure” patching is happening regularly, or they know patches have mostly been ignored for quite some time.
Regardless of how they answered, the outcome is usually the same.