The main problem is all the internal webapps that were written to support IE6, still works with IE8, and are very costly to rewrite, upgrade or replace. So in

The main problem is all the internal webapps that were written to support IE6, still works with IE8, and are very costly to rewrite, upgrade or replace. So in many cases they have to _add_ Firefox, they can't simply replace IE. That means even more user training (what, they've installed a second internet with a fox on it? Which should I use??), so the more tempting option is to just sit it out and wait, because they know that they will have to upgrade to Win7 or Win8 next year anyway if they still want security fixes.