As others have said, if your VMs are Linux, set up unattended_updates and forget about it.

If your VMs are windows, then Action1 is free up to 200 clients, it does need an agent installed, but that auto updates too.

That’s only true if someone guessing your pass phrase knows that it’s made up of words and not random characters.

The idea behind pass phrases is that these things are easy for your human brain to remember, but long enough to be hard to guess by typing random characters (or even combinations of words) by an attacker or a computer (or even a LLM)