I worked for a large financial institution in the early 2010s.

They ran Windows XP, IE 8, and they stuck with a 3-4 year old JRE to support one piece of shit line of business app that was used only by about 100 (out of 50,000) users internally.

That institution had endpoints popped by drive-by exploit kits dropping banking trojans like Zeus daily.