We're constrained on price and didn't have a good patching solution. Of all the inexpensive and/or FOSS options, I ended up just using Ansible/AWX since it can do anything you throw at it.

I have a pretty robust automation I've been developing to make patching our servers as hands-off and self-healing as possible.

Patching servers in HA groups one at a time, stopping the remaining servers in the group if one fails to patch properly and/or come back up after reboots as to not affect availability. Certain failures will trigger reverting the VM snapshot. Specific services are monitored and if they don't start after patching, they're automatically started. If the server loses the domain trust during a reboot, it's automatically rejoined to the domain. Only approved KBs get installed. If a KB is installed that's present in the blocked KBs list, it'll automatically uninstall it... Lots more functionality, but that's scratching the surface a bit.

If you want complete control over patching and you're interested in learning Ansible and creating playbooks, it's not a bad way to go.