Often times they are stuck using insecure browsers because some archaic piece of in house software depends on obsolete features only present in dated versions of browsers. They choose to skip updates because they don't want to spend the cash rebuilding the timekeeping system to work with anything other than IE <= 7.

Stated another way, for most large enterprises, the functionality of intranet in-house browsing for internal systems is more important than public web browsing. And this really is true for the enterprise's day-to-day business and ultimately profitability. Once you understand that, it naturally follows that the corpus of installed software and updates will be controlled to favor the former case at the expense of the latter.

This kind of thinking is what has lead us to the sorry security state we are in today. Why do we allow our providers to dictate to us that insecure software is a requirement for running their software. If enterprise pushed back on vendors for this issue we would be better off.

It isn't their fault alone. Lots of software has backward-compatibility breaking changes all the time. Maybe if all platforms ensured all existing applications worked correctly with every update, maybe by extraordinarily thorough testing or something.

You see, enterprise PCs are centrally managed and admins don't want something breaking because of the smallest of updates. They want to test their updates for a long time before they are pushed down to users. Auto-updating is exactly the opposite of what the enterprise wants, IMO.

Yes, which has led to countless other problems because users are running insecure browsers. Admins always want control, but it's not always better for anybody but the admins who justify their existence. I'm currently deploying a project in a business environment and we're requiring Chrome because of its auto-updating feature.