This sends a mail to root whenever there is a package to be upgraded, which in a stable release means mostly security updates. As a general matter, you should of course redirect the root mail to somewhere you can read it.
I have been using this for some years in a personal environment, and it works great.
I like setting up apticron. It willnotify by email and download, not install, the packages.
There are many ways and packages to do this, but I think the simplest way is this cron job:
This sends a mail to root whenever there is a package to be upgraded, which in a stable release means mostly security updates. As a general matter, you should of course redirect the root mail to somewhere you can read it.
I have been using this for some years in a personal environment, and it works great.