I keep telling my customers that they don't "need" to patch their Internet-facing Windows web servers in the same sense that they don't "need" to replace the oil filters in their car.

Look, yes, you ought to replace the filter every six months to a year, but will your car stop dead the very next day if you don't? No!

It also won't stop the day after, or the day after that. Ergo, by induction, we come to the conclusion that the 2012 R2 server on RTM patch level is not professional negligence.

It's just simple logic.

It’s a difference of degree, doses of magnitude of degrees. In fact, you should patch your serve on the order of years, just the same as your should patch your fridge filter.