The primary reason to defer updates is the risk that the updates will break existing functionality in a way that negatively impacts worker productivity. This c

The primary reason to defer updates is the risk that the updates will break existing functionality in a way that negatively impacts worker productivity. This could be bricking a laptop/server/computer, or causing software to stop working. The risk is particularly high for older software, which might be using deprecated or unofficial apis, or potentially may no longer be supported (when a vendor goes out of business there's nobody to call or pay). Many companies have customized existing software to the extent that they're incompatible with updates ie they've forked the software. In some cases, like the air traffic control software https://www.wired.com/2015/02/air-traffic-control/ https://www.wired.com/2015/02/air-traffic-control/, to change over they need to do a full-rewrite, which is very risky and may be missing functionality or just be buggier than the mature software you're using. For healthcare, banking and education there are some additional factors. These are all regulated industries, where all updates have to go through change management and testing in order to be compliant. In healthcare, updates are particularly uncommon as devices spend at 6+ months to years undergoing FDA certification. When a piece of software is updated, that update has to have gone through the FDA certification process before being applied.