A Simple Routine for Drupal Security Updates

Most Drupal compromises come from known vulnerabilities in outdated code. The Drupal Security Team publishes advisories for core and contributed modules, and acting on them promptly is the single most useful security habit.

The routine

Watch advisories. Subscribe to the drupal.org security advisory feed and check that your installed versions are covered.
Update on a copy. Run composer update for the affected packages on a staging environment, not production.
Run tests. Automated tests if you have them, plus a manual check of key paths: login, editing, search, forms, checkout if relevant.
Deploy with a rollback plan. Take a database backup, deploy, run drush updb and drush cr, and check logs.
Record it. Note what changed and when.

Keep updates small

Updating one minor version at a time is far easier than catching up on years of changes. Regular small updates are the cheapest form of security.

Beyond updates

Remove modules you do not use, keep roles tight, restrict who can use dangerous text formats, protect settings.php, and make sure file uploads cannot execute code.

If keeping up with this is not realistic in-house, a support plan is what it exists for.