Legacy software moves from technical debt to board-level cyber risk

In many organisations, the most troubling security weakness is not a cutting-edge cloud service or a freshly deployed AI tool. It is the old application still quietly handling payroll, claims or quoting, often written in Visual Basic 6, PowerBuilder, Access or another platform that has outlived the people who built it. For years, these systems were tolerated as expensive but dependable. In 2026, that calculation has changed. They are increasingly being treated as live cyber risks.

That shift is reflected in Bain & Company’s Technology Report 2026, which surveyed chief information security officers on where AI-era exposure is most concentrated. Legacy platforms emerged as one of the most material threats and one of the hardest to remediate without outside help. Bain’s conclusion is stark: technical debt should no longer be treated as an abstract nuisance, but as a security liability that needs to be retired, not merely wrapped in more controls.

The urgency comes from the pace of modern attacks. Bain estimates that artificial intelligence has compressed the typical cyberattack cycle from roughly four weeks to around 18 hours. Reconnaissance that once took days can now be done in about an hour, while lateral movement that formerly consumed a week may be completed in just a few hours. Microsoft has separately warned that threat actors are increasingly folding AI directly into the attack lifecycle, using it not just as a helper but as part of the attack surface itself. The result is a faster, more adaptive adversary that can exploit weaknesses before many organisations have even finished triaging them.

Defenders, meanwhile, are being deluged with more alerts. Bain says companies using AI-driven scanning have seen vulnerability notifications increase as much as eightfold. More than half of an organisation’s weaknesses, the consultancy found, sit outside its core business applications, buried in legacy systems, APIs and dependencies that receive less attention than modern cloud estates. That makes discovery easier, but it also exposes a harder truth: finding a problem is not the same as being able to fix it.

Bain’s mapping of the risk landscape is revealing. Cloud-native applications tend to sit in the safer, more manageable part of the matrix because they are easier to update and test. In-house code and open-source dependencies fall into a middle ground. But network layers, software-as-a-service vendors and legacy platforms occupy the zone where risk is high and remediation is least controllable. Legacy platforms attracted the greatest concern of the three, in part because their weaknesses are often structural rather than superficial. They are not simply badly patched; they are built on assumptions that no longer fit modern security expectations.

That is why many common legacy stacks are so difficult to secure in place. Microsoft ended support for Visual Basic 6 development tools in 2008, yet a great deal of VB6 code still runs important business processes through the Windows runtime, old COM components and third-party ActiveX controls that may no longer be maintained at all. PowerBuilder systems often rely on desktop clients connecting directly to databases with broad access rights, while many organisations remain on older versions because upgrading would mean retesting large parts of the business. Access applications can be even more fragile, with shared files and simplistic protection mechanisms that were never designed for determined intruders. In each case, the weakness is architectural. Firewalls and monitoring may buy time, but they do not remove the underlying exposure.

The problem is not limited to cyber defence. Bain’s separate research on agentic AI suggests that automation efforts often stall because the crucial business logic is trapped in old systems or in the heads of long-serving employees. An AI agent cannot apply rules it cannot see. If those rules are embedded in decades-old code, the AI programme depends on the modernisation of the legacy estate just as much as it depends on models, data and orchestration layers. IBM has made a similar point in its 2026 cyberthreat analysis, arguing that AI is simultaneously expanding the attack surface, accelerating attacks and improving defenders’ response capabilities. In that environment, outdated applications become more than a maintenance burden: they can slow both security and transformation.

Bain also argues that accountability needs to move up the chain. It recommends that CIOs and CTOs be held responsible for vulnerability debt, with boards receiving detailed reporting at least monthly. That is a significant change in tone. The old view was that legacy applications were an operational nuisance best left to IT. The new view is that they belong on the board risk agenda, alongside other enterprise exposures that can affect resilience, compliance and continuity.

For organisations that still rely on these systems, the implication is clear. Wrapping a legacy application in more controls may reduce immediate danger, but it does not eliminate the risk or prepare the business for a future in which AI-enabled attacks are faster, cheaper and more automated. Some vendors are now positioning modernisation platforms as a faster route out of that trap, promising to move old VB6, PowerBuilder, Access, WinForms, WebForms, Clarion and Delphi estates on to newer architectures such as Blazor on Azure while preserving business logic. Whatever route is chosen, the strategic point remains the same: the oldest software in the estate may now be one of its most dangerous.

Source: Noah Wire Services