I just tell them that anything below IE11 is a violation of corporate security standards and won't be supported.

We sell an enterprise web app to insurance companies and only this month fully dropped support for IE<11 after a year long campaign to reach out to our large IE 8 customers. The official MS drop of support at the beginning of the year was finally the ammunition we needed to make it a reality (by framing it purely as a security risk), but even then it took us a year to be comfortable pulling the trigger. But from someone who knows how difficult it can be: there is hope.

No wonder infrastructure gets hacked all the time. You'd think they'd at least go to embedded systems instead of using old PC's for these roles.

Send older clients unstyled no-JS HTML.

That's fine if you're B2C and selling direct to that 1%.

But if you're B2B then, you're not selling to that 1%, you're selling to a range of companies.

So 1% of end users having IE9 translates to 10% of your customers having (some) users with IE9.

Sometimes you're not even selling to companies, you're selling to partners or resellers selling to companies, so now that 10% of companies translates to 60% of your partners / resellers having (some) companies which themselves have (some) users with IE9.

So what was 1% of users can translate to much more than 1% of revenue lost just by dropping support.

And that's before I get started on how general those analytics are rather than breaking it down to office workers during work. Again, if your business is selling SaaS that targets workers then you'll likely come across a client with a need for older IE support sooner rather than later.

There's another reason why B2C is fine to drop support:

People are resourceful, if you have a website which breaks in IE9 then they'll probably just switch to chrome and it'll work fine if it's something they really want.

Companies however tend to be less flexible, if they know they have IE9 installed they'll insist on having "IE9 support" in the acceptance criteria, even if it's only installed on a few machines which likely will never be used with your software.

I'm actually happy to see bootstrap, jquery etc drop IE9 support because it makes it much easier during negotiation to drop support and push back against such proposals.

IE9 is still in extended support until April due to the fact it's the most recent IE that can run on Vista, and Vista is still in extended support until April 11.

You missed the 2% on IE 7.

If they're using XP to work with protected health information (PHI), and aren't on an extended service contract with Microsoft, they're accessing PHI on an insecure system and are, at least to how my team would interpret it, in direct violation of HIPAA.

In fact – and I too am not a lawyer, so don't consider this actionable advice – you might do well to throw up a warning, if not altogether disable access, to whatever product it is your users are accessing on XP, just to make sure you have all your HIPAA bases covered.