Out-of-date digital systems used to run essential services are now a strategic vulnerability for states and large organisations, according to a report published this week and supported by networking giant Cisco. The study, produced by the Australian Strategic Policy Institute and funded by Cisco, urges governments and critical infrastructure operators to treat technology lifecycle management as a matter of national security, not merely an IT problem.
Legacy systems become strategic liabilities
The central contention is blunt: many networks and applications that underpin public services and industrial operations were built for past threat environments and are nearing or past end-of-life. While such systems may continue to provide required functionality, the report warns they often lack the security controls, update pathways and observability demanded by modern cyber threats.
Newer generations of technology, the authors note, bring measurable improvements — for example, enhanced telemetry, stronger encryption, more robust identity controls and built-in capabilities for automated detection and response. But those benefits only materialise when modern platforms are deployed, maintained and governed through their full lifecycles.
"Functionality is not the same as defensibility."
The report’s formulation encapsulates the challenge: an application or device that still 'works' may nonetheless be indefensible against current attack methods if it cannot be patched, monitored or integrated into contemporary security architectures.
From a tech dilemma to a governance issue
Cisco and the report’s authors argue that the problem should be reframed from a technical headache into a governance shortfall. They present a practical framework, labelled the Legacy Five, intended to help public and private sector organisations make lifecycle risks visible, assign accountability and take measurable steps to reduce exposure.
- Recognise systems that are at or approaching end-of-life and quantify the risk they present;
- Assign clear ownership and accountability across government and enterprise for lifecycle decisions;
- Plan and budget for replacement, remediation or compensating controls rather than deferring action;
- Use procurement and standards to favour secure-by-design architectures and demonstrable upgrade paths;
- Establish monitoring and testing regimes so that migrated or retained systems remain observable and defence-capable.
The report emphasises that addressing legacy technology is an opportunity as much as a challenge: modernisation, if governed properly, can strengthen national resilience, improve public trust and enable participation in the digital economy.
Practical consequences for policy and procurement
For governments, the recommendations have immediate procurement and budgeting implications. The legacy problem is not limited to a handful of ageing servers; it spans industrial control systems, transport signalling, healthcare devices and administrative platforms. Where replacement is not immediately feasible, the report recommends compensating controls — segmentation, enhanced monitoring and identity restrictions — alongside plans and funding to replace unsupported components.
The authors also call for procurement rules and standards that favour systems with clear update paths and demonstrable secure-by-design properties. That approach would shift some of the lifecycle burden upstream, incentivising vendors to provide longer support windows and better telemetry out of the box.
| Characteristic | Modern systems | Legacy systems |
|---|---|---|
| Telemetry and monitoring | Richer | Often limited or absent |
| Security controls | Stronger encryption, identity | Unsupported, unpatched |
| Upgrade path | Designed for updates | No viable upgrade route |
For national security planners the message is stark: letting functional but unsupported systems persist increases the set of exploitable weaknesses available to adversaries.
Testing the claim behind the launch hype
As a technology desk we assess such proposals by practicality and measurability. The Legacy Five is useful because it converts a broad risk statement into discrete governance actions that can be audited: inventory, accountability, funding, procurement rules and observability. Those are actionable steps that civil servants and boards can implement without requiring miraculous new technologies.
However, translating guidance into outcomes will be hard. Modernisation programmes need sustained funding, cross-department coordination and vendor cooperation. They also risk short-term disruption where legacy replacements intersect with operational services. The report recognises this and recommends compensating controls where immediate replacement is impractical.
Ultimately, the report reframes ageing IT from an operational inconvenience to a national strategic risk, and sets out a practical route-map that policymakers can adopt. Whether governments treat lifecycle management with the same urgency they apply to other forms of national infrastructure will determine if the issue remains a background IT problem or becomes a priority for national security.
Kelvin Tang
Technology Editor, NEXO RADAR
