Infosec peeps: please chat with clients, friends, etc... I'm working on my next set of intern projects. What is the hardest defender thing to do (please stick with technical things that can be scripted)

Enterprise patch management

There's a lot there though... what parts do folks need most help on. (here's my hit list, what am I missing?) - patch testing/validation - deployment verification - rollbacks for issues - compensating controls for unable to patch for $reasons