Drupal websites may require security updates for Drupal core, and security updates for Drupal modules. The Drupal Security Team provides the following security release windows:

• Drupal contributed projects: Every Wednesday
• Drupal core: One Wednesday a month (typically the third Wednesday)

Acquia cannot estimate how frequently your website may need updates, as there are many members of the Drupal community that develop and maintain contributed modules, but you must take the security release windows into consideration when developing your application.

For a list of recent security advisories, see Security advisories on Drupal.org.