Upgrading / Patching Tomcat

As I understand it SC+ currently runs on Tomcat version 5.0.28. This seems to be a very old version of Tomcat - Released 28th Aug 2004, over four years ago(!) - and therefore I can only assume is unlikely to be as secure as the newer versions of 5.5 and 6.0.

We are hoping to put our SC+ system live via an externally-facing server and we would like to be secure in the knowledge that it is safe from attack. It's difficult to accept this on software which is over four years old.

Does anybody know what the impact of upgrading Tomcat to one of these newer versions would be, and whether there are any plans for AdventNet to do so any time soon?

Thanks in advance,
Andy