[mschwar99]

Often times they are stuck using insecure browsers because some archaic piece of in house software depends on obsolete features only present in dated versions of browsers. They choose to skip updates because they don't want to spend the cash rebuilding the timekeeping system to work with anything other than IE <= 7.

[T-hawk]

Stated another way, for most large enterprises, the functionality of intranet in-house browsing for internal systems is more important than public web browsing. And this really is true for the enterprise's day-to-day business and ultimately profitability. Once you understand that, it naturally follows that the corpus of installed software and updates will be controlled to favor the former case at the expense of the latter.

[WettowelReactor]

This kind of thinking is what has lead us to the sorry security state we are in today. Why do we allow our providers to dictate to us that insecure software is a requirement for running their software. If enterprise pushed back on vendors for this issue we would be better off.

[DufusM]

It isn't their fault alone. Lots of software has backward-compatibility breaking changes all the time. Maybe if all platforms ensured all existing applications worked correctly with every update, maybe by extraordinarily thorough testing or something.