I wouldn't say Microsoft is pretty good at updates. I once installed a patch for a security flaw in DNS in our Windows DNS server and got reamed by my boss for bringing our site down. I have found the policy of installing all updates when first setting up a Windows server and then never touching it again to work quite well. We also keep all non-HTTP access to a VPN.
Alternatively, don't use Windows. App Engine is my preferred platform for new projects and the security on that is most likely top notch and constantly upgraded.
Alternatively, don't use Windows. App Engine is my preferred platform for new projects and the security on that is most likely top notch and constantly upgraded.