More than 150 test scenarios before our scripts touch a client’s laptop.
Then a dummy VM with the client’s real setup, a pilot group at the client, and only then the whole firm. Every patch goes to the pilot group first, and nothing installs unless its fingerprint or its vendor’s signature checks out.