but the problem was that MS didn't have the updates in an easy to find place.

Um, I don't see how it could be any easier than http://windowsupdate.microsoft.com .

Okay, sure, you have to upgrade your version of IE to use the feature, but once you've done that, you can easily see which updates the OS needs and apply them with a single click. Don't see how it could get any easier.

The only reason my servers weren't upgraded was simply lazyness on my part. I assumed they were safe because they were on an internal-only network, and they were running stable. My standard operating procedure is "if it works, don't fix it", which has kept the servers stable for a long time. I was leery about applying upgrades if I didn't need them. So I allowed them to run without the security patches for a lot longer than they should have. But ease of locating the patches had nothing to do with why they weren't upgraded.