CERT and CIAC also have information about security patches, including links to vendor patches when applicable. Vendors release patches for reasons other than making our lives miserable. You need to convince them that an ounce of prevention is worth it. Apply the patches during that window. Not the most optimum, but it'll work.
Poster has some good advice for integrating security.
Their Intrusion Detection FAQ has a question about justifying IDS . Combine those items and apply them as necessary to your site and machines. Weigh the cost of taking the machine down for an hour early one morning to install patches to the cost of having to recover from a compromise. Present these in a professional manner to your higher powers. Not all patches require downtime or reboots.