Hospital network job taught me to stop trusting patch Tuesday

I did a weekend contract gig at a county hospital outside of Columbus last fall, and their server room had a single point of failure that scared me straight. They ran a legacy lab system on an unpatched 2012 box because the vendor said updates would break the interface, and the IT guy there told me 'we just pray nobody plugs in a bad USB.' That conversation made me rethink how I handle every client now, even small offices. I started checking for orphaned drivers and old firmware on anything that touches patient data, not just the obvious Windows updates. Cost me about 3 extra hours on each job, but I found two routers with default admin passwords and a PoE switch that was overheating because the firmware never got a reset. Has anyone else run into vendor lockout walls where the manual says don't update, but your gut says the hardware is rotting underneath you? I want to hear how you document that risk for the customer without sounding like a doomsayer.