Ask HN: Your automated Linux enterprise vulnerability/patch management strategy?

What is your solution? Are you happy with it? How would you improve it?

eg Do you use:

      1) configuration management tools (eg Ansible) and the distros package manager?

      2) managed services (eg tenable.io)?

      3) are there any viable open source (full or combination of projects) solutions?

      4) something else?