There is a plethora of reasons why an organization may still be running these older operating systems, but as any respectable security practitioner will say, applying patches is the first line of defense against network-based threats.