Along the same lines as your &#x27;where the fuck is the FDA&#x27; comment -- I&#x27;ve worked in Financial and Healthcare systems on and off for about the last 10 years.<p>I have seen SSAE16 audited companies that haven&#x27;t patched anything in years. FDIC examined institutions with ATM machines still running OS&#x2F;2 Warp(actually probably more secure than the ones running XP, with no updates installed. Ever.)<p>I once found the management interface of a SAN with a public IP address directly on the device, no firewall rules of any sort, and the device still had the default username&#x2F;password. It hadn&#x27;t been patched or rebooted in over 2 years.<p>More shocking is that a review of the logs didn&#x27;t show any successful unauthorized logins. Of course, they could have cleaned up after themselves, but further investigation was outside the scope of my engagement(They didn&#x27;t want to know. They were happy to present that, despite the oversight, there was no indication that PHI had been accessed by unauthorized people. Their conclusion, not mine.)