Patch-to-exploit gap, how do I avoid being a sitting duck?

Whats good-hygiene for protecting systems between when a vulns been exploited in the wild until it can be remediated? For the sake of argument let’s say it’s critical and affects the kernel. Obviously we’ll patch as soon as possible but that can only be done so fast…and that’s typically not fast enough. So what practices can be done in-between that period?

argument can critical cybersecurity exploit exploited fast gap good kernel patch protecting systems vulns