To be used as a key performance indicator:
Track the amount of package updates on a host for a given time frame (e.g. for weekly interval). Since there's multiple ways to install/update/remove packages the simplest solution would be a script which compares various states of "dpkg --get-selections". (An apt hook would be incomplete, since it would fail to detect package installed via dpkg)