1. A system for rolling security, comprising: a first server group of servers; a second server group of servers, each server in the first server group and second server group including software that includes an operating system and an application that supports user sessions; and a non-transitory computer readable medium storing instructions, the instructions when executed by at least one processor cause the at least one processor to: access rolling timing information generated based on monitored durations of previous user sessions established between the application and client devices, the rolling timing information indicating rebuild timings for the first server group and rebuild timings for the second server group, the rebuild timings for the first server group being staggered in time from the rebuild timings of the second server group; periodically initiate rebuilding of the software of each server of the first server group of servers according to the rebuild timings for the first server group; and periodically initiate rebuilding of the software of each server in the second server group of servers according to the second rebuild timings for the second server group, the rebuilding of the first server group of servers staggered in time from the rebuilding of the second server group of servers.