How are the efforts going to add LTS to Debian? I've always felt like the support cycle was one of the weaker points of the distribution from an enterprise standpoint.
Not all the Debian packages are covered by this security support, but there's a tool to check your installation (see the LTS wiki).
EDIT: I forgot that Freexian also provides a few more years, but I've never used that. I find that I need to upgrade more frequently to keep up with increasing security requirements anyway.