Legacy Systems

What are legacy systems?

Legacy systems are outdated but still operational IT or OT systems that the vendor no longer supports, or supports only partially, yet which continue to perform critical functions. They run on older hardware, operating systems or protocols and are frequently incompatible with modern security standards. In industrial environments they are the rule rather than the exception: a control system easily stays in service for 15 to 25 years, whereas an office PC is replaced after three to five.

In OT environments, legacy systems may continue to operate for decades, often without updates or vendor support. Replacement is costly and risky, so securing the surroundings of the system is usually the first step.

🧠 When is a system ‘legacy’?

A system is not legacy simply because it is old, but because it can no longer be maintained securely or reliably. Four characteristics keep recurring:

1. Older platform

• Windows XP, Windows 7, DOS, VMS, OS/2 or old Linux distributions
• Outdated PLC firmware, SCADA systems or HMIs

2. Limited or no support

• No more patches, updates or vendor support
• Spare parts become scarce and expensive, and knowledge leaves with retiring engineers

3. Incompatibility with modern technology

• No support for encryption, strong authentication or regular patch management
• Only older protocols, such as Modbus RTU without authentication or OPC Classic over DCOM

4. Critical function

• Controls essential processes that are difficult to migrate without production downtime or revalidation

📅 Which end-of-support dates turn systems into legacy?

Support ends on fixed dates. If you know those dates, you see legacy risks coming instead of being caught out by them.

The S7-300 shows that legacy is not just about software. Siemens recommends migrating to the S7-1500 or S7-1200, yet thousands of installations still run on S7-300 hardware. The same controller family was also the target of Stuxnet, the malware discovered in 2010.

🏭 Where do you find legacy systems in OT networks?

• SCADA or DCS dating from the 1990s or 2000s - often with a server and client environment on an unsupported Windows version
• PLCs or HMIs that communicate only over serial links - via RS-232 or RS-485, sometimes connected through a serial-to-Ethernet gateway
• Machines with vendor lock-in - custom firmware or software from a supplier that no longer exists
• Engineering workstations - an old laptop holding the only working version of the programming software
• Lower levels of the Purdue Model - levels 1 and 2, originally designed for isolated networks and therefore lacking built-in network protection

Legacy systems are typically business-critical and cannot easily be replaced because of cost, dependencies, certification or production downtime.

🔍 How do legacy systems differ from modern systems?

⚠️ What risks do legacy systems bring?

• Known, unpatched vulnerabilities - in May 2017, WannaCry spread through the SMBv1 vulnerability (MS17-010). On 13 May 2017 Microsoft took the exceptional step of releasing a patch for the long-unsupported Windows XP, which shows how large the problem was.
• Disruption caused by modern updates - Microsoft’s DCOM hardening (CVE-2021-26414) was enforced permanently on 14 March 2023. Old OPC DA connections between computers could stop working as a result if client and server were not configured correctly.
• Availability - failing hardware without available spare parts can halt a production line for days.
• No visibility - legacy devices log very little, so an attack or fault can go unnoticed for a long time.
• Loss of knowledge - documentation is missing and the engineers who built the system have left.

🔐 How do you secure legacy systems that cannot be patched?

When patching is impossible, you protect the system from the outside with compensating measures. IEC 62443-3-3 calls these compensating countermeasures: they bridge the gap between the target security level of a zone and what the device can do by itself. For legacy assets, this is where overall security is won or lost.

• Segmentation via Firewall, VLAN or the zones-and-conduits model - place legacy devices in their own zone and allow only strictly necessary connections
• Controlled access - use a Jump Server or Bastion Host for administration, never direct access from the office network or the internet
• Whitelisting and Application Control - on old Windows systems, only approved software can run, even without an up-to-date antivirus
• Monitoring via IDS, SIEM or anomaly detection - passive network observation gives visibility without loading the device
• Recoverability - an immutable backup or snapshots of virtualised systems do not replace a patch, but they ensure you are back up quickly after an incident
• Record the risks - document vulnerabilities, compensating measures and residual risk in the risk register

Migration is often desirable but, where it is not immediately possible, compensating measures are essential.

🧭 How do you tackle legacy systems step by step?

1. Take inventory - record every asset with version, firmware, operating system and support status in an asset inventory.
2. Assess the risk - link each system to the process it controls and determine the impact of failure or misuse.
3. Isolate and monitor - apply the compensating measures above, starting with the systems that have the highest impact.
4. Secure recovery - keep spare parts, backups of PLC programs and a working engineering workstation stored offline.
5. Plan replacement - include migration in lifecycle management and combine it with planned shutdowns or turnarounds.
6. Put it in the contract - require a support period and update policy from the supplier for new purchases.

Dutch and EU context. The Dutch Cyberbeveiligingswet, the national implementation of NIS2 in force since 15 August 2026, requires essential and important entities to take appropriate measures, including for outdated systems. The Cyber Resilience Act in principle does not apply to products placed on the market before 11 December 2027, unless they are substantially modified afterwards. The obligation to report actively exploited vulnerabilities, from 11 September 2026, does apply to manufacturers of those older products as well. NIST SP 800-82 (revision 3, September 2023) also addresses legacy OT explicitly.

❓ Frequently asked questions

Why are legacy systems in OT not simply replaced?

Legacy systems in OT often control processes that must not stop, and replacement requires new engineering, testing and sometimes revalidation or recertification. The cost and production downtime therefore often outweigh the short-term benefit. That is why organisations first isolate and monitor legacy systems and plan their replacement during a turnaround.

Is Windows XP in a factory still acceptable?

Windows XP has not received regular security updates since 8 April 2014, so it is only acceptable when the system is strictly shielded. That means its own network zone, application whitelisting, no internet or email access and administration through a jump server. Even then, the Windows XP system belongs on a replacement schedule.

What are compensating measures for legacy systems?

Compensating measures are security controls outside the legacy system that make up for what the system cannot do itself, such as segmentation, firewalls, whitelisting and network monitoring. IEC 62443 uses the term compensating countermeasures for this. They reduce the risk but do not remove the underlying vulnerability.

Does an old PLC fall under the Cyber Resilience Act?

A PLC placed on the market before 11 December 2027 is in principle not subject to the product requirements of the Cyber Resilience Act, unless it is substantially modified afterwards. The obligation to report actively exploited vulnerabilities does apply to the manufacturer for such older products as well. Under NIS2 legislation, the operator also remains responsible for appropriate measures.

How long does an OT system typically last?

OT systems such as PLCs, DCSs and SCADA installations often remain in service for 15 to 25 years or longer, far longer than the three to five years of a typical office PC. Hardware and operating systems therefore fall out of support halfway through the life of the installation. That mismatch is the core of the legacy problem in OT.

Does virtualisation help with legacy systems?

Virtualisation can decouple an old operating system from failing hardware, so a legacy SCADA or HMI application keeps running on modern servers. Snapshots also make recovery faster. However, virtualisation does not fix the software vulnerabilities of the legacy system itself, so segmentation and monitoring remain necessary.

📌 In summary

Legacy systems are outdated but functional systems that often support critical processes in OT, while the vendor no longer maintains them, or barely does. Because they cannot be patched or quickly replaced, you protect them with segmentation, controlled access, whitelisting and monitoring, record the residual risk and plan migration as part of lifecycle management.