Lucky for me, I've not had to deal with too many compromised servers where I work, but when I have, the thing that kills me is that an older version of service X was still being used. You've got to keep them up to date. The older the code, in my opinion, the more exploits there seems to be, or at least, the more the hackers might know about how to exploit.