There is no way to tell using the version number alone, they do not update the version number when you apply security hotfixes. To know for sure if all your hotfixes are applied you need to look at the lib\updates folder to see what jar files are in there, you may have applied some security hotfixes but not the cumulative hotfixes, etc.
Plug -- My company has a product HackMyCF that can show you excactlly what patches are missing, etc. Here's an example for a 9.0.1 server: https://foundeo.com/hack-my-cf/example-report.cfm