Frankly, the statistics in this article are not surprising, but they are concerning from a security perspective.  The burden involved in isolating, securing or otherwise managing legacy systems is tremendous for most organizations, and yet the overall reduction in risk is minimal.  At the end of the day, these machines can no longer be properly patched and will remain seriously vulnerable to compromise.

http://www.scmagazine.com/53-of-organisations-around-the-world-still-use-windows-server-2003/article/509180/