How to argue to patch internal systems?

Hi Everyone,

I am having trouble getting other departments to update the applications on our servers, let alone update the servers. For example, we still have Ubuntu 8 servers running Wordpress.

These servers are only in the internal private network behind the DMZ and are protected by perimeter security. They are basically not accessible from the outside, except the User is connected by our VPN. This is exactly the argument I get, why timely updates are not necessary.

I know …

cybersecurity patch systems