Backport question

I understand that Oracel/Sun backport software and integrate it into the Solaris Operating System.  However, my security folks, being vigilant workers, like to see versions increase instead of stagnant.  I am now left with the task of convinceing them that the vendor supplied software is perfectly safe to use and even actively maintained by the vendor.

My problem is where would I find articles/statements/pres releases...etc taht support this claim (thats the proof I need for the security folks).  I have been trying to navigate the Oracle site and either hit dead links or fail to find a decent page.  A knowledgebase article would be awesome, but I didnt really find much the supports that idea either.