We do scans on hospitals. They are really bad. Some won’t even apply patches.
You can thank the FDA for that. The health system where I work still has quite a bit of software running on Windows Server 2003 because the stinking FDA is so far behind in certifying 3rd party vendor applications on newer operating systems.
We patch everything that we're allowed to, segment our network to the point of insanity, and firewall everything, but some of these apps were written when Fred Flintsone was around.
It's ridiculous.