In most appreciations of risk around upgrades in environments with which i am familiar, changing config/static data etc counts as a systemic update and is controlled in the same way

You would lose a lot of the benefits of a system like crowdstrike if you waited to slowly roll out malware definitions and rules.

Survived this long without such convenience. anything worth protecting lives behind a firewall anyway