What is correct for security updates on Ubuntu apt-get upgrade -s | grep security or unattended upgrades?

Question

We want to perform only critical security updates on our Ubuntu Systems. We found two effective ways for upgrading security systems

One is using the apt-get upgrade and then use grep to filter security packages

root@vagrant-ubuntu-trusty-64:/etc/apt# sudo apt-get upgrade -s| grep -i security | wc -l
0
root@vagrant-ubuntu-trusty-64:/etc/apt#

The other is using unattended upgrades

root@vagrant-ubuntu-trusty-64:/home/vagrant# sudo unattended-upgrade --dry-run -d 2> /dev/null | grep 'Checking' | awk '{ print $2 }' | wc -l
32
root@vagrant-ubuntu-trusty-64:/home/vagrant#

As you can see the both are showing different result for packages, what is the correct way to update the security packages ?

Answer 1

You can use apt-check, which is used to generate the messages in the motd,

/usr/lib/update-notifier/apt-check --human-readable
7 packages can be updated.
7 updates are security updates.

Answer 2

Another command to see list:

apt list --upgradable | grep security

Answer 3

Why unattended-updates is not (always) the correct way for this: It only does what is configured in /etc/apt/apt.conf.d/50unattended-upgrades. This should reflect security updates of the current distro.

Further it only upgrades packages, that don't need manual intervention.

And last it's not the fastest tool for checking if there are upgrades pending.

For Ubuntu the (already marked) answer from Iain is the best choice.