Do I need to install SQL Server service packs to continue receiving security patches It's always been my belief that SQL Server needs to be updated to the latest service pack in a timely (and tested) manner to continue receiving security/bug patches.

I'm now partially responsible for a 2008 R2 DB that has not had any service packs installed. The external IT company mainly responsible for maintaining it has told me that they don't install service packs unless there is a specific business need, and that it would automatically recieve security patches any way. Is this the case, or do you need to keep up-to-date (once tested) with the latest service pack?
It's always been my belief that SQL Server needs to be updated to the latest service pack in a timely (and tested) manner to continue receiving security/bug patches.


You are correct. Some service packs will continue to have new CUs until their lifetime runs out.


  ... and that it would automatically recieve security patches any way.


They either didn't understand how this worked or flat out lied to you.


  Is this the case, or do you need to keep up-to-date (once tested) with the latest service pack?


You'll need the latest SP + Patches. For example, since you're on RTM... you're missing quite a few different security patches because they weren't made for the RTM branch after it went out of support*.

*Note that the links above show the same security updates released for supported service packs at the time. However, RTM was not one of them.