In my experience it's more because their compliance team hasn't blessed the newer version for general use. These large organizations don't put the autonomy with

In my experience it's more because their compliance team hasn't blessed the newer version for general use. These large organizations don't put the autonomy with individual teams to make such decisions to upgrade technology. So everyone is looking at a centralized authority who then feel the pressure to make a perfect decision, which turns into a hesitation because they also don't have a great process to evaluate a complex piece of technology like the JVM and declare it "perfectly safe and secure". So then the status quo wins. They will even pay companies like Azul to maintain support for Java 7 or 8, rather than making the leap. (And yes, there's probably a small contribution to this problem from source code that's hard to migrate, but as good as Java's been about backward compatibility, I don't think that's a big contributor in earnest.)