There are multiple vendor products that exist to fulfill this purpose, and unfortunately we have to use more than one of them.
They are not foolproof; Microsoft SCCM may think we don't have any versions of Adobe Flash installed older than X.Y, but then (another product) finds a slew of them, while also missing versions of Internet Explorer below Y.Z.
(I think the divide comes, like all Microsoft solutions, where Microsoft products work best with Microsoft products but not third-party products, and third-party products work best with third-party products but miss the mark on interfacing with Microsoft products. Also inconsistent version string parsing across solutions)
What it comes down to is having some sort of agent on every local workstation that reads from the respective registry and reports software versioning information to a central server. From the central server you get an overview of what percentage of your infrastructure is up-to-date, and what remains vulnerable.
In a separate workflow, another server (something like WSUS, but again, the Microsoft divide rears its head) then forces update agents on the non-compliant workstations to update within compliance during the next update window. Automation tools like Puppet and Chef can be deployed to achieve something like this cross-platform; it's a simple problem with well-documented solutions.
Do NOT leave it up to users to diligently update. They won't, even under threat of firing.