I've never been much of an update person.  I went from Win 7's original release to SP1, and after that I've just pretty much left it alone.  I don't know if my PC has all sorts of security issues or not.  Everything I do online is done through Sandboxie.  My system works fine, and I've never found any malware on it when I use the free checker tools. Regardless of that, for whatever reason it's finally occurred to me that maybe I should get my system more currently updated.

I've read A LOT about updating Win 7, how it stopped for the most part in January 2020, etc.  To make a long story short, this is what I've done, and I'd like some opinions on whether I should do more, or do anything differently.  [Note: I installed these updates on a fresh Win 7 SP1 x64 system, but the goal is to integrate them into the ISO and reinstall]

Installed, I believe in this order, based on what I read was needed in order to get the big updates to install:

KB4474419: SHA-2 update

KB4490628: Servicing Stack update from 3/2019.  [the Microsoft Update Catalog site didn't show it as being replaced by a newer version, so I assumed it was needed even when later versions of SS updates were released?]

KB4536952: Servicing Stack update from 1/2020 [didn't know if this was needed]

KB3125574: Convenience Rollup from 5/2016

KB4534310: 1/14/2020 monthly rollup

KB4534314: 1/14/2020 security update

Done.

Everything installed without issue.  No glitches, no flickering monitor, nothing.  I had read that beginning in April 2019, PciClearStaleCache.exe needed to be "present" in order for monthly rollups to install.  Wasn't exactly sure what that meant, but I also read that it only needed to be included in the same folder as whatever monthly rollup was being installed and it would install.  So that's what I did.  After I installed the 2016 Convenience Rollup, I put PciClearStaleCache.exe and the Jan. 2020 monthly rollup in the same folder, and it installed.  So my update path was Win 7 SP1 ISO > Convenience Rollup > Jan. 2020 rollup.

I've never liked the idea of letting Windows install updates automatically, so I've always had them turned off.  I let it scan my system after the updating I did and it showed 21 important, 33 optional.  The majority of them were older ones, before 2016.  When I looked at the KB numbers on the Microsoft Catalog Update site, all of them showed as being replaced by the big 2016 Convenience Rollup I installed, so I'm not sure why it shows these updates to begin with?  Other than a security update to .Net Framework, none of the more recent ones seem "important."  I don't use Internet Explorer or Edge, and I'm not concerned with time zone or currency updates for countries half a world away.

Sorry for the long post, but any thoughts on what I've done, how I've done it, or if I should do more?  Thanks.

or just use simplix
at least it won't give you telemetry and nag screen kb's