Generally speaking, if your organization had the expertise it's likely that you wouldn't have security issues. They are not cheap, but cheap is relative. Many times the most expensive security issues are the ones discovered by hackers or unscrupulous employees. Best practices have to be brought into each area a piece at a time. It's a simple question, but often the answer is no.
Managers have to be able to support an environment cleanly and affordably to ensure security.
Patch updates must be checked for on a regularly scheduled basis. Regular maintenance windows must be scheduled and accepted as a part of life. If downtime for a maintenance window is not acceptable, look at implementing technologies that allow for failure so that users can be kept running, and change one system at a time. Maintenance and change logs should be kept religiously. Programmers must test code with real-world data in an isolated environment.