Back in the dark ages when I was CISO at Siebel, I mapped lack of aggressive patching to significant downtime across the enterprise and that to dollars lost due to missed customer commitments. Ended up consolidating the IT org and forced patching on very tight timelines.