Topic starter
25/06/2026 12:13 am
TL;DR: Legacy operational technology in critical industries is creating a widening security gap as ransomware rises, average breach costs remain high and many systems cannot be patched, according to Imprivata. The governance problem is not age alone but the collapse of visibility, patchability and least-privilege control in systems that cannot easily be replaced.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Experts Discuss the Challenges of Protecting Legacy Infrastructure from Increasing Cyber Threats in Critical Industries”.
By the numbers:
- Ransomware attacks on U.S. critical infrastructure rose 9% in 2024, according to the FBI cited by Imprivata.
- Critical infrastructure organisations saw an average breach cost of $4.88 million, according to IBM's 2024 Cost of a Data Breach report cited by Imprivata.
Key questions
Q: What fails first when legacy OT cannot be patched or replaced?
A: The first failure is usually governance, not technology.
Q: Why do unpatchable systems increase healthcare breach risk?
A: Unpatchable systems increase breach risk because they accumulate exposure that defenders cannot remove quickly, while attackers only need one weak path to exploit.
Q: How do security teams know whether exposed legacy services are actually under control?
A: They need a complete inventory of externally reachable services, proof of ownership, and evidence that the protocol is still required.
Practitioner guidance
- Inventory unpatchable OT assets Map which critical systems cannot be patched, replaced or rebooted safely, then classify them by operational criticality and exposure path.
- Prioritise privileged access containment Reduce standing administrative access to legacy systems and require tightly scoped privileged access management for operators, engineers and third parties.
- Close visibility gaps on critical assets Instrument the systems that matter most with telemetry that can distinguish normal operating variance from suspicious commands or failed access attempts.
Bottom line: Legacy OT creates a security problem that cannot be solved by patching alone because the most critical systems are often too fragile or too essential to replace.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 9:04 am
Legacy OT security exposes a visibility deficit before it exposes a vulnerability deficit: The article shows that many critical environments are not failing first because of exploit novelty, but because defenders cannot reliably see the state of their most important assets. When monitoring is weak, security teams lose the ability to separate normal operational fluctuation from hostile activity. The practitioner conclusion is that visibility is part of the security perimeter in critical infrastructure.
A few things that frame the scale:
- The global average cost of a data breach reached $4.99 million in 2026, up 12% on the previous year, according to IBM's 2026 Cost of a Data Breach Report.
A question worth separating out:
Q: Should critical infrastructure teams prioritise PAM before major modernization projects?
A: Yes, when the environment contains systems that will remain in service for a long time. PAM, vendor access governance and least privilege can reduce immediate exposure even when modernisation is slow, because they narrow the number of paths an attacker can use against fragile assets.
👉 Read our full editorial: Legacy infrastructure security gaps are widening in critical industries