Or just not upgrading the entire operating system, say for example in an industrial control system. Because we find that this old version of SSH no longer compi

Or just not upgrading the entire operating system, say for example in an industrial control system. Because we find that this old version of SSH no longer compiles on modern operating systems. Thus making the whole system more vulnerable, so that it can keep communicating with some 10-year old device that cannot be easily replaced. Again, air-gapping and limiting the physical extent of the network to the room or building would provide significant protection against attacks here.