Legacy Windows in OT: what practitioners need to act on now

TL;DR: Legacy Windows remains embedded in European OT estates, with TXOne Networks reporting that 51% of organisations had incidents involving legacy Windows systems in the past 12 months and that operational disruption remains the main barrier to security deployment. The practical question is no longer whether to modernise, but how to reduce exposure without breaking production.

Editorial analysis by NHI Mgmt Group, based on content published by TXOne Networks: “The Legacy OT Dilemma Part 2: The 2026 Update”.

By the numbers:

• 51% of organisations experienced cybersecurity incidents involving legacy Windows systems in the past 12 months, up from 43% in 2025.
• One in six say more than 75% of their operational infrastructure depends on legacy Windows.

Key questions

Q: What breaks when legacy Windows is still running in OT environments?

A: What breaks is the assumption that standard enterprise patching, endpoint enforcement, and upgrade cycles can be applied without operational impact.

Q: Why do legacy Windows systems increase operational risk in industrial environments?

A: They extend the lifespan of unsupported software inside environments where uptime, compatibility, and vendor dependencies make fast remediation difficult.

Q: What do security teams get wrong when they try to protect OT environments with traditional security tools alone?

A: A common mistake is assuming firewalling and log analysis are enough for OT.

Practitioner guidance

• Map every legacy Windows asset to operational criticality Build a current inventory of Windows-based OT hosts, then classify which systems are essential to production, which are partially replaceable, and which can only be protected in place.
• Prioritise zero-disruption controls for production systems Require proof that any endpoint or network control can deploy without modifying the system, without maintenance windows, and without interrupting OT applications.
• Coordinate segmentation and endpoint coverage Align network inspection, segmentation policy, and host protection around the same asset map so no legacy platform sits in an unmonitored seam.

Bottom line: Legacy Windows remains deeply embedded in OT, so unsupported systems must be governed as a long-term exposure rather than a temporary exception.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →