[masraum]

There are lots of places that are so bad at installing security updates that they've practically left the doors and windows open or left the keys in the lock on the front door or whatever. And if you've got 100 servers, and 1 has a hole, it's possible for a bad person to exploit that one hole to gain access to that one server or the information on that server. Once they've done that, they may then be able to hop from that server to some/any of the rest of the servers because that server is trusted.

And never underestimate the likelihood of an employee, even an IT employee, clicking on a link or attachment in a bogus email.