Paying for maintenance is part of a viable risk management plan. Due diligence is a measure of the size of the risk. Eventually, the risk will outweigh the cos

Paying for maintenance is part of a viable risk management plan. Due diligence is a measure of the size of the risk. Eventually, the risk will outweigh the cost of checking. Some firms will track the cost vs risk and act based on that, others wait until it explodes. e.g. The company is using software stack "D", and is launching a new business. They have no money. If they get sued, they close up shop and move on. They have a successful funding round and get an injection of $100m. This hits the news, and they are immediately hit with a lawsuit alleging copyright infringement through their use of "D" (GPLv3 perhaps?). Somewhere between launch and funding there was a point where the cost of diligence (detecting the license problem) would have dropped below the risk adjusted settlement cost (remediation + lawyers fees + lost sales), hopefully allowing the lawsuit to be avoided. Then again, it might never have crossed below. Knowing that line is an acceptance of the risk. That's also perfectly valid.