Applying Patches/Updates

This topic has been well documented over the years.
Really, you can be extra proactive and expend lots of time and resources applying patches on a daily/weekly basis.
Or, you can be reactive and apply patches really only on a as-needed or some other kind of basis. Including when critical notifications are posted within InforXtreme, which should be read and interpreted and applied as necessary/required.

We apply patches as needed or if a critical notification is posted. I agree with Roger that too much time would be expended apply all patches. For instance, we only pay in one state so any patches for other states/countries are not applied unless they are rolled into a patch that we do need.

My typical recommendation is to not be particularly pro-active with patches as that way lies madness (we have a rather vigorous change control practice and the testing alone will eat us alive).  Keep up with Application Service Packs, which are (usually) released on a predicable schedule and that should reduce the number of patches you need to apply in a reactive manner (and it will reduce the overall impact of the patches you do end up applying).

I don't recommend applying CTPs or environment patches unless a specific issue has been identified. You must test every program that is being updated because its always a crapshoot as to whether the patch will break something else. Stick to being timely with service packs (annually is good) and only apply patches when needed.