Legacy OT systems: what it costs to replace versus protect

TL;DR: Legacy OT systems can remain operational for years if organisations use purpose-built controls such as virtual patching, application control and protocol inspection, rather than forcing replacement after an incident, according to TXOne Networks. The governance test is whether resilience can be extended without handing attackers a crisis-driven modernization window.

Editorial analysis by NHI Mgmt Group, based on content published by TXOne Networks: “The Million-Dollar Question: Replace or Protect Your Legacy OT Systems?”.

Key questions

Q: How should organisations secure legacy OT that cannot be patched quickly?

A: Start by separating unpatchable systems from standard enterprise assets and treating them as a distinct risk class.

Q: When does segmentation stop being enough for an old industrial network?

A: Segmentation stops being enough when the attacker can still reach the vulnerable system through trusted paths such as vendor access, removable media or an internal foothold.

Q: What breaks when unsupported OT systems are left in service too long?

A: The failure is usually not just technical exposure.

Practitioner guidance

• Define a legacy OT risk-extension policy Classify unsupported production systems by business criticality, patchability and outage tolerance so leadership can choose between replacement, segmentation and life extension on a documented basis.
• Deploy compensating controls that do not alter the host Use virtual patching, application allowlisting and protocol inspection for systems that cannot tolerate reboots, agents or operating system changes.
• Map remote access and vendor workflows Review every pathway that can reach the legacy environment, including vendor support channels, shared accounts and removable media, then constrain those paths to the minimum necessary scope.

Bottom line: Legacy OT systems often fail under standard hardening assumptions because they cannot tolerate the reboots, agents or patches that enterprise security expects.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →