Isn't OpenBSD a special case? Most really security conscious organizations seem to use outdated tools, because the new tools haven't been vetted/verified/etc yet.

(That is one reason I stay away from security work. The theory is fascinating, but the practice is just not fun.)