Technical debt

Legacy and end-of-life systems in the age of AI-assisted attacks

The NCSC's concern is old weaknesses found at speed. Patching alone may not fix unsupported technology, so replace it or bring it back into support.

Last reviewed against National Cyber Security Centre, SecurityWeek and Cyber Security News. Sources

A factory site linked by a hub to a phone with a shield

The problem

Tech on the cheap

Dr Horne said: "For decades, we have collectively got away with doing tech on the cheap." [9] The NCSC argues that AI will uncover and exploit long-standing weaknesses, and calls for urgent investment in resilience [1].

His list of common failings, as reported, included running end-of-life systems for another year, delaying necessary upgrades to save costs, and failing to maintain technology across its lifecycle [8].

Options

What to do with an old system

The NCSC's patch wave advice sets out the choices [4].

Connected devices arranged around a wireless hub

Replace it

Plan and budget for upgrades throughout the technology lifecycle [8].

A hooded figure at a desk with several monitors showing downloads in progress

Re-support it

Patching alone may not fix end-of-life technology, so bring it back into support where that is possible [4].

An industrial site with some buildings flagged in red and virus shapes above

Reduce its exposure

Where it cannot be replaced yet, start by removing or limiting external exposure [4]. The NCSC also advises not connecting technology to the internet unnecessarily [1].

Priorities

Which first

  1. 1

    Anything unsupported and reachable from the internet.

  2. 2

    Anything unsupported that holds privileged access or sensitive data.

  3. 3

    Anything unsupported on an internal network only.

This order follows the NCSC's emphasis on external systems first [4]. Our judgement is that internal-only systems still need a plan, because valid accounts are one of the four routes in [7].

A padlock beside a rising bar chart

Who decides

A board question

Replacing old technology is a budget decision before it is a technical one. The NCSC chief's call is for leaders to choose to invest with urgency [9]. A short register of unsupported systems, with an owner, an exposure rating and a replacement date for each, gives a board something concrete to approve.

Keep reading

Read next

A server on fire linked by recovery arrows to a clean server and a laptop

Response plan

The NCSC's priorities include protected backups and rehearsed incident response. How to test yours before AI-assisted ransomware arrives.

Read the guide Three people around a laptop with question marks above them

Questions

Short, sourced answers on the NCSC's warning of AI-powered ransomware against UK critical infrastructure by 2028 and what organisations should do.

Read the guide A ring of people with question marks around one seated, worried person

Who is affected

Which UK organisations the NCSC's AI warning points at, from critical infrastructure to small businesses, and how to tell where you sit.

Read the guide

How CyPro can help

Need a hand getting ready?

Reading the rules is one job. Mapping them to your organisation, closing the gaps and showing the evidence are several more. CyPro's consultants can take any of them off your plate.

Security lead advising a board

Fractional CISO for the board

A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.

More on cypro.co.uk
Penetration tester probing an application for weaknesses

Penetration testing

A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.

More on cypro.co.uk
Cyber security consultants planning hardening work

Hardening and segmentation

Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.

More on cypro.co.uk
Security analysts monitoring systems around the clock

24/7 security monitoring

Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.

More on cypro.co.uk
Incident responders containing an attack

Incident response

If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.

More on cypro.co.uk
Scanner checking internet-facing systems for weaknesses

Vulnerability scanning

Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.

See the scanning service
Talk to us Book a Free Consultation
Rocket launching from a cloud

Get ready

Need to know what this means for you?

The NCSC expects ransomware to get faster and cheaper to run. CyPro can help you plan and rehearse your response before an attack and take charge of containment and recovery if one happens.

See Cyber Incident Response Book a Free Consultation