You cant reconciliate mandatory IE6/8 and the need for security in the corporate world. I understand some corps cant upgrade because they have software that only runs on XP.By the way this is a direct consequence of MSFT rejecting web standards in the years 200X and going VB/activeX/non standard IE apis. Some web clients will never be updated and wont run in anything but IE6-8. Whereas if your devs tried to use cross browser features only in 2005,chances are your web app is future proof and needs little update. The irony is your 2005 flash site may still run, even today, on all desktop browsers.
edit: If they even can install other browsers. If they're lucky they will have a LTS release of Firefox available.