Some 9% of companies surveyed by business software maker Spiceworks are still running at least one instance of Windows Vista. More striking is that more than half of the businesses surveyed—52%—have at least one PC running Windows XP, an even older, albeit more respected, version of Windows. Microsoft ended support of Windows XP, which debuted in 2001, in 2014.

Other Spiceworks data reveals Windows XP is running on 14% of all business PCs worldwide. Windows Vista has much lower penetration there, running on just 1% of the PCs tallied. Meanwhile, eight-year old Windows 7 runs a whopping 69% of all business PCs worldwide.

Get Data Sheet, Fortune’s technology newsletter.

The figures come from Spiceworks’s recent 2017 OS Adoption Trends report, which examined anonymized data collected from “hundreds of thousands” of IT professionals who use Spiceworks software to manage their networks. The company supplemented that by surveying 461 information technology professionals.

A whopping 90% of those surveyed said they worry about the risks posed by the use of old, unsupported operating systems which are easier to attack and more susceptible to malware. That puts both corporate and personal data at risk.

It’s hardly unusual for people to put off upgrading their software. One reason is that change is hard and disruptive. Updates of one product can break other products. Another reason is that upgrades cost companies—and their employees—money and time.

But the risks of failing to update operating systems (or other software) are real. Stats like these are fodder for Microsoft (MSFT), which is always pushing users to get up to date.

Last year, other Spiceworks research showed that the current Windows 10 release had been adopted by 54% of organizations surveyed, up from 38% last July. Windows 10 launched in July 2015.