Determining the appropriate patchsets to install

Is there a way to "autocheck" what patches are applicable to a specific system?  It seems that we always apply our quarterly update, then a month or so later, a vulnerability scan will indicate that there is yet another patch or two that needs to be applied between the quarterly updates.