They don't. We occasionally take it off the secure net and update it through our internet proxy. Then we scan it for viruses etc and put it back to the secure net. This is roughly every month. Obviously this scheme doesn't allow real-time updates but is lets us maintain central patch management and configuration control. If you have any better ideas, I'm open to suggestions.