Reply to post:

Speaking to a friend of a friend who works in a relevant department in the NHS, the estimate for patching legacy systems was £15m, and the budget given to them was £750k. There are also a lot of million quid bits of equipment out there with software from bankrupt or disappeared companies that requires XP or similar, and YES they shouldn't be connecting these machines to SMB shares at all, but it's never just been as straightforwards as just patching some computers.