New to CM12 are Automatic Deployment Rules (ADRs). It's a way to bring to CM12 what WSUS had natively; the ability to automatically approve updates and deploy them. We'll show an example of how to create one to update Endpoint Protection definitions, but the concept can be used for all software updates.
Have a target collection created for a group of machines, which will serve as a pilot for new definitions before sending them to the rest of the company. Updates have to be downloaded to a source location before they can be pushed out to DPs. On a server of your choice (yes, the primary or CAS is OK for this too), create a share for the patches, for example, \\FileServer\Patches$. The share permissions will need your ID to write the patches and the primary site server's machine account to read them.