Dennis Cox from BreakingPoint Systems has a great blog post on Cisco's security update scheme, I'd personally recommend all of you to read it. Cisco Becomes The Weakest Link In National Infrastructure Security

I agree with most of Mr. Dennis' points (not necessarily the conclusion :), especially the first one, "1) Twice A Year Is Not Enough".

We can't expect Cisco to release updates on a monthly basis, but twice a year is obviously not enough.

btw: What about Huawei?