
Test the updates ?
If one administers a bank of holding companies (or hold a bank of adminsitration companies or ... ) one would suggest that one would be prudent enough to either have ones own wsus server which pushes, or to at least have a way to bless wsus updates before rolling them out.
If an update is fatally broken, the reg (and a gazillion other techie websites) are more then happy to splatter the fact that the wupdate is broken all over your face ...