For sure. When software runs and operates as expected, then the mindset is, "Don't touch it". No one cares that the JRE is old and vulnerable or that it's runni

For sure. When software runs and operates as expected, then the mindset is, "Don't touch it". No one cares that the JRE is old and vulnerable or that it's running telnet with the user name and password both set to 'admin'. Updating is considered more dangerous than the risk of compromise. I heard a security researcher once say that her greatest fear for SCADA/control systems was compromise by kids/teenagers who had no idea what they had access to and began goofing around on the system. She said that they could accidentally cause more damage than organized attackers.