You seem to be making a large mistake here. The issue in question here isn't "Upgrade a webapp" or "Only use IE6". The issue is "Upgrade a webapp for one user"

You seem to be making a large mistake here. The issue in question here isn't "Upgrade a webapp" or "Only use IE6". The issue is "Upgrade a webapp for one user" or "Make that one user use IE6, rather than add another application to the list of applications to watch bug reports/updates/etc for". Yes, the application should upgraded at some point, but just because a user wants to use Firefox is not the reason to be doing it. It is something that needs to be done, sooner rather than later, but this may not be the time, and definitely is not the reason to do it. While I personally use Firefox, and think it would be an improvement if every used it, I would not want to be in an IT department pushing it. A large focus of the article was about limiting choice for users, which is what the complaint was. "Why can't I use XXXXXX, it just takes 5 minutes to install..." does not mean that after 5 minutes of installing it that any service will be done. Updates will need to be run, testing (should be) run to make sure it works in all the necessary cases, integration into whatever imaging/software management system the organization is using... The list goes on. On top of that, each additional application installed in the organization opens up that much more attack space, and puts the entire organization that much more at risk. Yes, it isn't that big of a deal to let one or two users use Firefox. But once you've done that, when the next user wants Adobe Air installed, so they can have their Twitter application installed, its a lot harder to say no. Usually this snowball effect doesn't really apply, but with the ease of automated attacks it does. Take spamming. Most users know not to trust spam. Even more may know not to click on any links. But even with a 1 in 10,000 (or lower) success rate, spamming still turns a huge profit, simply because its trivial to send out a million emails, which would result in ~100 successes. The same applies to applications. Without proper testing and updating, applications are vulnerable, and it is relatively trivial to scan a network searching for a given vulnerability. Even if the IT department is really on top of the game, and is watching the news and finds patches right away for their products, all it takes is one application somewhere to have not taken the patch right, or to be running an older version of the software, for an attacker to gain a foothold into the organization. From there it becomes significantly easier to gain access to anything they want.