Windows Server 2012 and 2012 R2 will no longer be supported. There are significant security risks with continuing to use the software.
The biggest threat in your office could be your operating system. If you are still using Windows 7, there is no time left. You must upgrade.
Patch programs do little to address your overall cybersecurity needs, especially if patching continues to be a "when I get to it" task.