Why not test the lack of change instead of just testing change?

Wouldn't it be great if companies and managers did more stringent testing
on not upgrading than upgrading? For example, if IBM issues any PTFs you
would have to run though extensive testing to prove your systems were not
susceptible to any of the things fixed in those PTF's if you chose not to
put them on in a very timely fashion?
If you chose not to upgrade operating systems you had to prove that your
systems had all the stuff in place to handle whatever the new OS could do?
Such as RCAC, enhanced ciphers, etc?

There needs to be more fear in staying behind than the fear of change.




Rob Berendt