Legacy Windows risk is deepening across European OT environments

At a glance

What this is: This survey shows legacy Windows still anchors many European OT environments, while incident rates and deployment friction are pushing operators toward zero-disruption protection models.

Why it matters: It matters because OT teams have to govern Windows-based operational risk without relying on IT-style controls that can interrupt production, and that has direct implications for endpoint, network, and identity-adjacent access decisions.

By the numbers:

• 51% of organisations experienced cybersecurity incidents involving legacy Windows systems in the past 12 months, up from 43% in 2025.
• One in six say more than 75% of their operational infrastructure depends on legacy Windows.

Context

Legacy Windows in OT is a governance problem as much as a technical one. Operators are often stuck with systems that cannot be upgraded quickly because they are tied to equipment compatibility, uptime requirements, and vendor support gaps, so the control challenge becomes how to reduce exposure without interrupting the production floor.

The article frames this as a growing operational risk in European industrial infrastructure, not an abstract technology refresh issue. That makes it relevant to teams responsible for OT security architecture, segmentation, endpoint coverage, and the access boundaries that keep legacy systems usable but contained.

Key questions

Q: What breaks when legacy Windows is still running in OT environments?

A: What breaks is the assumption that standard enterprise patching, endpoint enforcement, and upgrade cycles can be applied without operational impact. Legacy Windows in OT often remains because the surrounding equipment and processes cannot tolerate disruption, so the failure is not just technical obsolescence but a control model that depends on conditions the plant cannot safely meet.

Q: Why do legacy Windows systems increase operational risk in industrial environments?

A: They extend the lifespan of unsupported software inside environments where uptime, compatibility, and vendor dependencies make fast remediation difficult. That combination increases the likelihood that malware, unauthorised access, or ransomware can persist long enough to affect production. The risk is amplified when security teams assume IT-style tooling will fit OT without adjustment.

Q: What do security teams get wrong when they try to protect OT environments with traditional security tools alone?

A: A common mistake is assuming firewalling and log analysis are enough for OT. Those controls are valuable, but they are still passive and can miss stealthy attackers, ransomware staging, and exploitation attempts against exposed assets. Teams also underestimate the need for rapid isolation once suspicious activity appears. In OT, slow containment can turn a security event into an operational outage.

Q: How should organisations balance legacy replacement with protective controls?

A: They should stop treating replacement and protection as mutually exclusive. The article shows many operators now see dedicated protection as cheaper than immediate replacement, which makes sense when equipment, downtime, and support constraints are factored in. The right approach is to protect the installed base while sequencing replacement based on risk and criticality.

Technical breakdown

Why legacy Windows persists in OT environments

Legacy Windows remains in production because industrial systems are built around long equipment lifecycles, specialised applications, and operating constraints that make standard enterprise refresh cycles unrealistic. In OT, the operating system is often embedded in the process itself, so replacing it can mean recertifying equipment, revalidating applications, and risking downtime. That creates an exposure profile where unsupported platforms continue to run long after mainstream support ends. The security problem is not just age, but the mismatch between IT renewal assumptions and operational reality. See the OT Security Guide.

Practical implication: Treat legacy Windows as a long-term exposure domain and build security controls around containment, monitoring, and compensating protections rather than assuming replacement will arrive quickly.

Why IT endpoint controls often fail on the plant floor

Conventional endpoint protection is optimised for enterprise devices that can tolerate agents, frequent updates, and more aggressive policy enforcement. OT endpoints are different: performance sensitivity, vendor constraints, and process availability can make those assumptions unsafe. The result is a control gap where tools either create operational friction or are not deployed at all. In practice, the question is whether a control can protect legacy hosts without modifying them, requiring maintenance windows, or disrupting OT applications. That is why zero-disruption design becomes a security requirement, not a convenience. See the Patch Management Guide.

Practical implication: Validate every endpoint or inspection control against production constraints before rollout, and reject any design that depends on downtime or host modification.

How network segmentation and endpoint protection have to work together

Legacy OT risk grows when network monitoring, segmentation, and endpoint protection operate as disconnected layers. Attackers do not need to defeat every control if they can move through the seams between them, especially in flat or partially segmented environments. Defence has to be coordinated so network controls catch lateral movement and endpoint controls reduce host compromise, with both tuned for industrial protocols and operational uptime. That is a classic control-integration problem: the architecture must account for where one layer stops and the next begins. See the Lateral Movement Guide.

Practical implication: Align network and endpoint controls around the same asset inventory and traffic model so gaps between tools do not become the path of least resistance.

Threat narrative

Attacker objective: The attacker seeks to disrupt operations, gain unauthorised access, or deploy malware and ransomware against vulnerable legacy Windows systems.

1. Entry occurs through legacy Windows systems that remain exposed in OT environments because they cannot be upgraded or replaced quickly.
2. Escalation takes advantage of weak protection, unsupported software, or operational gaps that allow malware, unauthorised access, or ransomware to take hold.
3. Impact appears as repeated incidents, production disruption risk, and a larger attack surface across critical industrial environments.

Breaches seen in the wild

• Schneider Electric Jira breach 2024: Credentials linked to a Lumma infostealer infection gave Hellcat access to Schneider Electric's Jira; 40GB and 400,000 user rows claimed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Legacy Windows in OT is now a standing governance problem, not a temporary technical exception. Industrial operators are still running systems that support production but sit outside normal patch and upgrade assumptions. That means security programmes have to govern unsupported platforms as enduring assets, with compensating controls that acknowledge operational continuity. The practical conclusion is that legacy risk management belongs in architecture and governance, not in one-off remediation projects.

Zero-disruption security is the real evaluation standard for OT controls. The article shows that performance impact, application conflict, and lack of expertise are not side issues, they are the reasons many controls never reach production. In OT, a control that cannot be deployed safely is not a control, it is a proposal. Practitioners should evaluate any protection strategy by whether it can operate without changing the process it is meant to defend.

Security fragmentation creates the gaps attackers use in industrial environments. Network visibility, segmentation, and endpoint protection are often bought and deployed separately, but legacy OT risk spans all three. That creates blind spots where one control assumes another will catch the event. The named concept here is OT control seam risk: the exposure created when separate tools do not share a common view of assets, protocols, and operational constraints. Practitioners should close those seams first.

The shift in buyer intent matters more than the headline incident rate. A growing share of organisations now believe protecting legacy systems is cheaper than replacing them, which signals a practical move from replacement-first thinking to protection-first planning. That does not mean modernisation stops, but it does mean operating models will increasingly rely on layered containment, monitoring, and lifecycle extension. The implication for practitioners is to treat legacy protection as a funded programme, not an emergency exception.

OT security planning must assume prolonged coexistence between old and new platforms. The article points to a reality in which Windows XP, Windows 7, and other legacy systems may remain in service alongside newer hosts for years. That makes access governance, segmentation, and detection coverage part of the same problem. Practitioners should design for coexistence, not for a clean cutover that never arrives.

What this signals

OT legacy risk is becoming a control architecture issue, not just a patching issue. The deeper lesson is that unsupported systems do not create one security failure, they create a persistent governance gap across inventory, containment, monitoring, and lifecycle planning. For practitioners, that means the programme question is how to sustain protection around systems that will remain in service longer than originally planned.

Zero-disruption protection is the operating model OT teams should now expect. If a security control cannot preserve production traffic, coexist with old operating systems, and avoid host changes, it will remain theoretical in many industrial environments. The practical implication is that control selection has to start from operational tolerance, not from enterprise endpoint norms.

OT control seam risk: the exposure that appears when segmentation, endpoint protection, and monitoring are deployed as separate layers without a shared operational model. This is where incidents often hide, because each tool assumes another layer will close the gap. Practitioners should design for shared asset visibility and coordinated enforcement across the entire OT stack.

For practitioners

• Map every legacy Windows asset to operational criticality Build a current inventory of Windows-based OT hosts, then classify which systems are essential to production, which are partially replaceable, and which can only be protected in place.
• Prioritise zero-disruption controls for production systems Require proof that any endpoint or network control can deploy without modifying the system, without maintenance windows, and without interrupting OT applications.
• Coordinate segmentation and endpoint coverage Align network inspection, segmentation policy, and host protection around the same asset map so no legacy platform sits in an unmonitored seam.
• Use incident history to drive replacement sequencing Give priority to the sites and business units that already experienced incidents involving legacy Windows, since the survey shows those organisations are more likely to invest in dedicated protection.
• Test protection assumptions against downtime tolerance Validate whether security tooling can sustain production traffic even during failure, because OT teams cannot accept controls that become outages when they misbehave.

Key takeaways

• Legacy Windows remains deeply embedded in OT, so unsupported systems must be governed as a long-term exposure rather than a temporary exception.
• The survey shows incident pressure is rising while operational disruption still blocks many defensive deployments, which creates a widening gap between risk and control coverage.
• Practitioners need protection strategies that work in place, preserve uptime, and align network and endpoint controls around the same operational reality.

Related NHI Mgmt Group resources: OT Security Guide · OT Asset Visibility Guide · Lateral Movement Guide · Patch Management Guide

Key terms

• Legacy Windows Systems: Legacy Windows systems are older operating systems that remain in service beyond their standard support window or are difficult to retire quickly. They often carry higher exposure because patch availability, operational constraints, and incomplete hardening make them more vulnerable to widely known remote access flaws.
• Zero-disruption security: Zero-disruption security is a deployment approach that protects production environments without changing the systems or processes they support. In OT, it means controls must avoid maintenance windows, host modification, and traffic interruption while still reducing exposure and improving detection coverage.
• OT control seam risk: OT control seam risk is the exposure created when segmentation, endpoint protection, monitoring, and other safeguards are deployed as separate tools without shared visibility or enforcement. Attackers often exploit the gaps between those tools, especially in industrial environments where uptime constraints limit how controls are implemented.
• Compensating Control: A compensating control is a measure that reduces risk when the ideal fix, such as immediate patching or redesign, is not possible. In OT, compensating controls often include session recording, access restriction, and tighter monitoring. They do not eliminate the underlying issue, but they narrow exposure until safer remediation can happen.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course, the industry's only accredited NHI security programme. It is a fit for practitioners who need to connect access governance and machine identity thinking to broader security programmes.