Security risks of obsolete hardware/software

We get regular reports of our internal, and our external, network from
Qualys. Also some benevolent hacking is done. Areas of concern are
ranked in layers of severity with 5 being the area of highest concern and
1 being the area of lowest concern. The one issue we have at a level 5 is
only because the software is obsolete and is no longer issued updates.

<snip>
THREAT:
The Cisco VPN 3000 Series provides remote access deployments for IP
Security (IPsec) and Secure Sockets Layer (SSL) VPN connectivity.

Technical support ended on 31st August 2012. Support services for the
product are unavailable, and the product is obsolete.

IMPACT:
The system is at high risk of being exposed to security
vulnerabilities. Since the vendor no longer provides updates, obsolete
software is more vulnerable to attacks.
SOLUTION:
Cisco recommends migrating to the Cisco ASA 5500 Series SSL/IPsec VPN
Edition. Information about this product can be found at Cisco ASA.
COMPLIANCE:
Not Applicable
EXPLOITABILITY:
There is no exploitability information for this vulnerability.
ASSOCIATED MALWARE:
There is no malware information for this vulnerability.
RESULTS:
OS obtained: Cisco VPN 3000 Concentrator
</snip>

This has been on the report for awhile so apparently my boss doesn't think
it's really all that great a priority. Or perhaps it's asking for budget
money the same quarter that manufacturing tries to load up is unlucky.

Would you or your boss?
Would you or your boss have a concern if that was about some level of IBM
i that you were running that is now obsolete (or will be in a few months)?

Rob Berendt