It boils down to this. An upgrade costs money, sometimes a lot of money, but the result has no visible outcome. In fact, in many cases the only outcome is an assurance that you've reduced the probability of attack, intrusion, breach and related unpleasantness. By any measure, that's a tough...
Tag – Owasp
New Top 10 List of the Most Critical Security Risk to Web Applications, Is Your Application Vulnerable?
Independent OWASP Top 10 Security Risk Audit for Python-based Websites.