We have some linux(ubuntu) based VMs running in the cloud in a private network and they do not have external/public IP address. We have some apps running on those servers and everything is working fine. My question is: are there any arguments for doing regular updates on those machines? How about security patches only? 

The counter arguments I came up with are:

* Updates would create some downtime for our service
* updates can break things
* time spent updating + testing things still work after update can be spent somewhere else
* these machines do not have internet access so we need to enable it during the updates which is itself a security risk.

PS: Of course, bastion hosts will be fully secured/patched.

[![enter image description here](https://i.stack.imgur.com/2OU9B.png)](https://i.stack.imgur.com/2OU9B.png)