[KillerDiller]

The lack of budget is easily fixed when mature financial planning (which is completely normal for non-IT resources) and internalization of externalities is applied by requiring a working and budgeted lifecycle for every newly established IT system.

Forced internalization of externalities and transparency of risk (by vendors establishing both a firm lifecycle and a patching regime) provide the right incentives to make that happen.

In other words, the world of networked devices is a world of constant change. It must rid itself of those not fit for that change. People can run XP until the sun burns out, they just can't connect it to anything that's not theirs.