It’s a hard decision only because it can mean some pretty significant work on your part to make sure updates are clean and go through as they should. It means testing, maintenance windows and yes, the occasional hiccup. You can minimize the uncontrolled elements (the "hiccups") though with a proper approach to testing and making sure your applications and application vendors are keeping up compatibility-wise.
The downside to NOT updating your systems are significant. It’s critical to stay on top of updates, whether they’re OS updates or SQL Server updates.
The key is testing, then applying the update in a controlled manner, then testing the results so you can more easily sleep at night. This last step can save you a good deal of worry, it also gives you and your stakeholders the confirmation they need to make sure the update applied correctly and that applications are still working as needed.
Essentially, think about having a test plan that you work through (can be a checklist, demonstration of the software, whatever it takes) that will confirm that all of the components of your system came through the update fine and that your applications are not behaving in a way that you’re not expecting.
My own typical approach is to run a report, query or extract prior to the update – then after. Compare key elements. You should also have functional checkpoints to show that things are still working as needed. Run an operation in your key areas and make sure you’re getting the results you expect. This should be true of a new installation, an update, a service pack application, etc. Checklists are an excellent way to stay on top of hitting all of the key elements that you need to check up on.
I haven’t been bit by service pack issues for many, many moons. It’s not to say some off-the-beaten path function won’t be impacted, but with careful testing, planning and regular updates, you’ll find that you can keep up, protect your systems with the latest and greatest and still have a well oiled machine. (No, don’t go oiling your server…)
The last step is to go update your checklists with anything you learned about the process, and write down things you experienced, what you did, what the outcome was. This knowledge base of information for updates will serve you well going forward.