Puppet or Cfengine to actually run the updates on the machines. Then you can run a vulnerability checker, such as nessus, to verify that the updates are installed.