you can also try this, It will allow you to scope your search by collection, and to get number of missing updates (possible to sort it by missing update) .
, get total of targeted updates (approved updates), as well as a lot of client SU scan info. Then you'll get the ability to drill down for the detail of the missing updates;
http://anotherblabla.wordpress.com/2012/03/22/sccm-security-updates-compliance-overview-report-v2/
and if needed you can change the where clause of both reports to something like and this way get all the appropriate update clasification;
and catinfo2.CategoryInstanceName in ('Security Updates', 'Critical Update')
Simon Brouillard
