I've observed that several of our users are ignoring messages sent from IT Security managers, and also the system generated "You just sent a virus" notifications. The problem seems to be among people ...
Does every security patch get back ported to every .NET framework? Are there exceptions to the rule?
I can imagine a scenario where Microsoft will create a security patch for some versions of .NET and not others. This might occur in occasions it's too expensive to regression test and back port all ...