Shielding servers instead of updating them?

Let's talk about large environments, chaos, high turnover, backlogs, neverending projects.

They are not even closing tickets, let alone update servers running x, y or z.

Pentesters (and external "hackers) are succeeding via outdated software on our servers, let's say PaperCut and similar having Remote Code Execution exposed to web.

IPS won't protect as this is exposed via firewall over HTTPS
WAF won't protect as usually we just have waf on "e-commerce or web portals" not on actual web "products". …

chaos code code execution cybersecurity environments exposed external hackers high ips large papercut projects protect remote code remote code execution running servers software tickets turnover update web