Security usually isn't the reason. Typically they have old versions of large software suites (like SAP) which had a ton of custom development done by external consultants, worth millions of dollars. If they want to upgrade to a new browser, they need to upgrade to a new version of the platform, which in turn means upgrading all those custom developed solutions. The cost outweighed the benefit for a long time.
It's no longer that much of an issue though. IE6 is starting to die off in the enterprise space. Once apps get on IE7 they're easier to upgrade thanks to microsoft's backwards compat support in newer IE's. I'm hopeful that IE9 will get adopted more quickly than IE7 and IE8 did.
It's no longer that much of an issue though. IE6 is starting to die off in the enterprise space. Once apps get on IE7 they're easier to upgrade thanks to microsoft's backwards compat support in newer IE's. I'm hopeful that IE9 will get adopted more quickly than IE7 and IE8 did.