Develop a reference and test environment for new patches
When you dispose of a sandbox and a baseline of reference, you can check updates in an IT subset that is reliable, isolated, and resembles your production environment as closely as possible. Repair scenarios or scenarios of failed installations can be tested there too.
Having a sandbox available (and if possible an acceptance environment too) allows you to detect faulty updates on your test production stations and potential incompatibilities can be identified without risk of harm.