[ale] When to upgrade?

[Nick Travis]

I was debating whether or not I should upgrade the version of my disto
on a couple of systems.  One of these is a production system and one
is not, but it is pretty important.  Both are on the Internet so
security is a concern.  Is there a general rule as to when the OS
needs to be updated?  For example, if I'm running SUSE 9.0 are there
any risks associated with not upgrading to 9.2?  What if its 9.1?