Everything is a risk. Upgrading is risking business disruption, not upgrading is risking having previously unknown low-level vulnerabilities being discovered and exploited, aside from possibly hitting max limits that don't exist in newer versions. There are still NT 4 and IE 6 installations out there. Stability is a holy grail that we strive for and frequently achieve.

I've always thought that the best sign of a database is that management doesn't really know that you're there because everything runs smoothly. It doesn't mean that you're not occasionally sweating bullets behind the scenes, but the users never notice problems.

We did a firewall replacement/upgrade 3 weeks ago or so, and our networking admin is still trying to fix things. Part of that is an incompetent vendor who doesn't yet realize that this was their last job for us.