Legacy infrastructure security gaps are widening in critical industries

At a glance

What this is: This is an Imprivata analysis of how legacy OT in critical industries widens cyber risk when systems are too mission-critical to replace and too fragile to patch.

Why it matters: It matters because IAM, PAM and NHI programmes in critical sectors must account for unpatchable assets, weak telemetry and constrained access patterns that turn every control failure into an operational risk.

By the numbers:

• Ransomware attacks on U.S. critical infrastructure rose 9% in 2024, according to the FBI cited by Imprivata.
• Critical infrastructure organisations saw an average breach cost of $4.88 million, according to IBM's 2024 Cost of a Data Breach report cited by Imprivata.

Context

Legacy OT refers to operational technology that runs industrial and critical-infrastructure systems, often for decades, with limited built-in security features. In this article, Imprivata argues that the core problem is not just ageing equipment but the mismatch between modern threat pressure and systems that cannot be safely swapped out or patched on demand.

That mismatch creates an identity and access governance problem as much as a technology problem. If defenders cannot see what is happening, cannot rotate access cleanly, and cannot enforce least privilege around fragile systems, then IAM, PAM and vendor access controls become part of operational resilience rather than back-office security hygiene.

Key questions

Q: What fails first when legacy OT cannot be patched or replaced?

A: The first failure is usually governance, not technology. If a critical system cannot be patched or swapped out, defenders must rely on visibility, access restriction and compensating controls. When those are weak, the organisation loses confidence in whether the asset is safe to operate or already compromised.

Q: Why do unpatchable systems increase healthcare breach risk?

A: Unpatchable systems increase breach risk because they accumulate exposure that defenders cannot remove quickly, while attackers only need one weak path to exploit. They often lack modern telemetry, cannot run agents, and depend on ageing credentials or management interfaces. That combination creates a durable opportunity for persistence and movement.

Q: How do security teams know whether exposed legacy services are actually under control?

A: They need a complete inventory of externally reachable services, proof of ownership, and evidence that the protocol is still required. If TCP/23 is open, telnetd is present, and no retirement plan exists, the service is effectively uncontrolled. External scanning and asset attestation should be part of the governance loop.

Q: Should critical infrastructure teams prioritise PAM before major modernization projects?

A: Yes, when the environment contains systems that will remain in service for a long time. PAM, vendor access governance and least privilege can reduce immediate exposure even when modernisation is slow, because they narrow the number of paths an attacker can use against fragile assets.

Technical breakdown

Why legacy OT creates an unpatchable trust problem

Legacy OT often runs on long-lived platforms with hard-coded dependencies, vendor-managed maintenance paths and limited maintenance windows. In practice, that means vulnerabilities persist because the system owner cannot apply the normal patch-and-restart cycle without risking downtime or safety impacts. The result is a trust problem: the environment is forced to rely on compensating controls, segmentation and access restraint rather than remediation. For critical industries, this changes the security model from continuous hardening to controlled exposure management.

Practical implication: treat unpatchable OT as a permanently exposed trust boundary and design access controls around that constraint.

How missing telemetry turns small faults into security blind spots

Telemety gaps matter in OT because defenders lose the ability to distinguish routine operational variation from active compromise. Without real-time insight into device state, authentication events, or unusual command paths, teams cannot reliably tell whether an alert is a process anomaly or an intrusion precursor. That creates dwell time risk and makes early containment much harder. In critical industries, visibility is not just about detection after compromise. It is the prerequisite for knowing whether the asset is healthy enough to trust at all.

Practical implication: prioritise telemetry coverage for the systems that cannot be replaced or patched, not just the ones that are easiest to instrument.

Why PAM and vendor access controls matter more when systems cannot be modernised

When an environment depends on legacy OT, privileged access becomes the narrow path through which administrators, operators and third parties reach the asset. That makes PAM and vendor privileged access management central controls, because the attack surface is often not the machine itself but the human and service accounts allowed to interact with it. Least privilege, session oversight and tightly bounded vendor access reduce the blast radius when the underlying system remains difficult to secure directly. This is especially important in sectors where uptime pressure can lead to standing exceptions.

Practical implication: tighten privileged and vendor access around legacy assets before you assume the asset itself can be hardened.

Threat narrative

Attacker objective: The attacker aims to disrupt essential operations, create leverage through downtime, or turn fragile industrial dependencies into a wider business and public safety problem.

1. Entry often begins through privileged remote access or a weakly monitored legacy pathway into OT-connected systems, where attackers can blend into legitimate maintenance traffic.
2. Once inside, the lack of visibility and patchability makes credential abuse and control manipulation harder to detect, especially when access is already expected for operations.
3. The impact stage is operational disruption, safety risk or broad service outage, which is why these environments carry both cyber and real-world consequences.

Breaches seen in the wild

• Colonial Pipeline ransomware attack: A dormant VPN account with a leaked password and no MFA let DarkSide shut down a major US fuel pipeline for six days.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Legacy OT security exposes a visibility deficit before it exposes a vulnerability deficit: The article shows that many critical environments are not failing first because of exploit novelty, but because defenders cannot reliably see the state of their most important assets. When monitoring is weak, security teams lose the ability to separate normal operational fluctuation from hostile activity. The practitioner conclusion is that visibility is part of the security perimeter in critical infrastructure.

Unpatchable infrastructure creates a permanent compensating-controls dependency: Some OT systems cannot be patched without unacceptable operational risk, so the governance question becomes how long the organisation can sustain exposure without assuming remediation will arrive later. That is a different operating model from enterprise IT, where patching is usually the primary response. The practitioner conclusion is that segmentation, access restriction and monitored administrative paths must carry more of the security load.

Identity governance becomes the primary control plane when the asset cannot be changed: If legacy OT cannot be modernised quickly, the access model becomes the most controllable variable. Least privilege, PAM and vendor access governance matter because they limit who can reach systems that will remain fragile for years. The practitioner conclusion is that access policy is now a resilience control, not just an IAM control.

Critical infrastructure security is shifting from hardening assets to constraining behaviour around assets: The article points toward a long-term model in which organisations secure the operating envelope around legacy systems rather than trying to make the systems themselves behave like modern platforms. That is the only realistic path when mission-critical equipment outlives its original security assumptions. The practitioner conclusion is to govern the people, vendors and privileged pathways around the asset as tightly as the asset itself.

Legacy OT risk is a governance problem with sector-level consequences: When hospitals, utilities, manufacturers and power systems are involved, downtime is not only a corporate issue but a public-impact issue. That means OT security programmes need stronger ownership, clearer service accountability and more realistic recovery assumptions than standard enterprise risk registers provide. The practitioner conclusion is to treat legacy infrastructure resilience as a cross-functional governance duty, not a siloed security task.

From our research library:

• The global average cost of a data breach reached $4.99 million in 2026, up 12% on the previous year, according to IBM's 2026 Cost of a Data Breach Report.

What this signals

Legacy OT turns access governance into resilience governance: In critical industries, the question is no longer whether every asset can be modernised quickly. The question is whether the organisation can constrain privileged behaviour tightly enough to keep fragile systems trustworthy while they remain in service.

Identity controls are now the practical compensating control for unpatchable infrastructure: When the system cannot be changed, the people, vendors and service accounts around it become the controllable surface. That makes PAM, vendor access review and session oversight the first-line disciplines for legacy environments.

The operating model is shifting toward controlled exposure rather than full remediation. For practitioners, that means prioritising visibility and least privilege on the systems whose failure would have the widest operational impact.

For practitioners

• Inventory unpatchable OT assets Map which critical systems cannot be patched, replaced or rebooted safely, then classify them by operational criticality and exposure path. Use that inventory to decide where compensating controls must remain permanent rather than temporary.
• Prioritise privileged access containment Reduce standing administrative access to legacy systems and require tightly scoped privileged access management for operators, engineers and third parties. Limit vendor sessions to approved workflows and keep them monitored.
• Close visibility gaps on critical assets Instrument the systems that matter most with telemetry that can distinguish normal operating variance from suspicious commands or failed access attempts. Where native logging is weak, add compensating monitoring at the network and session layers.
• Build resilience around replacement constraints Assume some OT will remain in service for years and design access, segmentation and recovery plans around that reality. Do not wait for a full modernisation cycle before tightening the controls that reduce blast radius today.

Key takeaways

• Legacy OT creates a security problem that cannot be solved by patching alone because the most critical systems are often too fragile or too essential to replace.
• The article ties this risk to a 9% rise in ransomware attacks on U.S. critical infrastructure and a $4.88 million average breach cost for critical infrastructure organisations.
• For practitioners, the immediate response is to treat visibility, PAM and vendor access governance as resilience controls around systems that will remain exposed for years.

Key terms

• Legacy Operational Technology: Legacy operational technology is industrial or infrastructure control equipment that was designed before modern cyber threats became routine. It is often difficult to patch, replace, or monitor, which makes identity and access controls more important than platform remediation alone.
• Compensating Control: A compensating control is a measure that reduces risk when the ideal fix, such as immediate patching or redesign, is not possible. In OT, compensating controls often include session recording, access restriction, and tighter monitoring. They do not eliminate the underlying issue, but they narrow exposure until safer remediation can happen.
• Vendor Privileged Access Management: Vendor Privileged Access Management is the control of privileged access granted to external suppliers, contractors, and service providers. It governs how third parties receive, use, monitor, and revoke elevated access to systems and data. In practice, it combines identity verification, least privilege, session oversight, approval workflows, and periodic access review.
• Operational Telemetry: Operational telemetry is the current data generated by systems about their active state, usage, and condition. For identity programmes, it is valuable because it turns abstract records into evidence that can support entitlement reviews, offboarding, and spend decisions with less manual reconciliation.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.