How do we handle incremental patching with VxRail?

How do we handle incremental patching of hardware or software components within the VxRail environment?  If a security or vulnerability patch is released by VMware for one of the components within the software stack, how are they handled?  Do we have to wait for the entire VxRail image to be updated by VMware before we can apply individual hotfixes or patches?