Surprisingly many get away with only rudimentary security controls. I have a client that absolutely refuses to upgrade off Rails 2.3, even to the drop-in Rails

Surprisingly many get away with only rudimentary security controls. I have a client that absolutely refuses to upgrade off Rails 2.3, even to the drop-in Rails LTS releases. Their "web director" keeps insisting that no one would want to infiltrate and that there's no damage can be caused by a compromise of Rails anyway. The frightening incompetence of that guy is maddening. Incidentally, I don't think he was put in place to sabotage the company. Just a case of well-meaning nepotism.