I figured you would say that, and yes I can figure that out my self also.
However, it is very normal in larger companies to run a version or two behind because everything has to be veryfied and approved, that being both browsers, plugins and sofware.
It is pretty common that our own developers here also live in a world where they think customers always will run on latest or just update - they had some big surprises over time on that account.
However, it is very normal in larger companies to run a version or two behind ...
As long as we all can agree that this is just the sad truth and not some kind of "best practice"...
Anyway: since we're now part of the Sophos family, we have a solution for this too, it's called "Endpoint Protection". The brand new V10 offers Patch Assessment. Please forgive this shameless plug ;-)