Legacy system

A legacy system is defined less by age than by support status: the point at which a vendor's end-of-life (EOL) date passes and security patches stop being issued. After that date, any newly disclosed vulnerability with a CVE identifier remains unremediated for the product's whole remaining life, so the exposure only grows. Well-known examples include Windows 7 (extended support ended January 2020) and Windows Server 2012/2012 R2 (October 2023); Windows 10 reached end of support in October 2025, after which the Extended Security Updates programme became the only route to patches (offered free to EEA consumers for a transitional year, and paid for organisations). The problem is compounded when the system also cannot run modern platform defences - DEP, ASLR, driver signing, TLS 1.2/1.3, TPM-backed measured boot - because it was built before those existed, so even a fully patched-to-EOL build lacks the mitigations that make later exploitation harder.

Legacy is especially entrenched in operational technology and embedded contexts: industrial control systems, medical devices, building management and manufacturing lines often run decade-old Windows Embedded, VxWorks or bespoke firmware certified as a unit, where patching may void safety certification or require a plant shutdown. Protocols there frequently predate authentication entirely (Modbus, DNP3, older OPC), so the host cannot simply be hardened in place. This is why frameworks treat legacy as a risk to be managed rather than eliminated, and why the first control is always an accurate inventory: CIS Critical Security Controls v8.1 Control 2 (software inventory) and Control 1 (enterprise assets) exist precisely because you cannot protect or decommission what you have not catalogued.

Because in-place remediation is unavailable, the standard treatment is compensating controls: place the system on an isolated network segment or VLAN with strict allow-list firewall rules, remove or heavily proxy internet access, disable unused services and removable media, apply application allow-listing so only known binaries run, and put an IDS/IPS or protocol-aware monitor in front to watch its limited, predictable traffic. Virtual patching at a network or WAF layer can block known exploit patterns without touching the host. These measures align with defence-in-depth and, for regulated entities, with the risk-management obligations of NIS2 Article 21 and ISO/IEC 27001:2022 Annex A, which accept residual risk only when it is documented and consciously owned.

Two common misconceptions cause trouble. First, air-gapping is often assumed to be absolute, but data-transfer needs (USB updates, engineering laptops, historian links) create bridges that malware has repeatedly crossed. Second, "it still works, so it is fine" ignores that reliability and security are different properties: a system can be perfectly functional and simultaneously trivially exploitable. The genuine long-term fix is planned migration or replacement with budget and a timeline; compensating controls buy time for that project, they do not substitute for it.