How often to update?

I am a newbie systems admin.

At present I am in a heated discussion with a application vendor about how often I can update my RHEL 5.9 production server.

I dont have a test instance of the server and application so testing is not possible.

My opinion is that once every month is a safe bet? The server is web facing, and mission critical so security is important. I have had cases where some of the vendor apps stopped working after an update even though they state that they fully support RHEL 5.9.

I dont want to wait months as it increases the bulk of updates that has to be checked should an issue occur. The vendor states every 18 months (?? Whoa!) but I must make sure that all security issues is dealt with. So I take responsibility either way....
 

What is best practice and what makes sense on a RHEL server?

Regards