29/05/2026
The Most Dangerous Words in IT: “It Still Works”
It's usually a worry when you hear the phrase “Don’t touch that” in a server room.
It’s usually said with a half-joke and a grimace. Everyone knows it’s referring to the old box that “still works”, runs something important, and has survived so many fixes and workarounds that no one feels confident touching it anymore.
That’s legacy debt.
Not just “old tech”, but old tech that’s become a dependency. The kind that quietly builds up risk until it eventually turns into downtime, a security issue, or an emergency upgrade at the worst possible time.
A legacy debt audit is a fast way to bring that risk back into the light.
What Legacy Debt Really Looks Like
Legacy debt isn’t just “old gear”. It’s old gear that’s become normal.
It’s the server running a critical app. The edge device no one remembers buying. The workaround that somehow turned into a permanent fix (that's a whole topic in itself - there's nothing more permanent than a temporary fix). Over time, it all stacks up quietly.
The problem is easy to ignore until it isn’t.
Legacy debt creeps in even in well-managed environments. It slowly adds constraints, increases cost, and limits your ability to respond when something goes wrong.
The real risk shows up when “old” becomes “unpatchable”.
Once something can’t be updated, its weaknesses don’t go away. They just sit there, waiting for the wrong day. There’s no clever workaround that makes an unsupported system truly safe, only ways to reduce risk until you replace it.
You also start to see it in the basics slipping.
Patching becomes inconsistent. Logs aren’t reviewed. Services stay running that no one actually needs. Backups exist, but haven’t been tested. When these fundamentals drift, legacy debt turns into a reliability and incident-response problem, not to mention a security one.
And more often than not, the highest risk is sitting right at the edge, exposed to the internet.
The 3 Oldest Risks to Find First
If you’re running a legacy debt audit, don’t overcomplicate it. Start with the areas where age and impact overlap.
These are the ones that tend to hurt the most.
Risk #1: End-of-support edge devices
If you’re looking for high-impact legacy debt, start at the edge.
Firewalls, VPN gateways, and routers are your front door. When they hit end-of-support, they don’t just become outdated. They become harder to defend because security updates stop arriving.
They might still be doing their job, but without a safety net.
What to check in your audit:
List every edge device (firewalls, VPNs, routers) and confirm its support status
Identify which ones are internet-facing and what services are exposed
Flag anything that can’t run current firmware or no longer receives updates
Risk #2: Obsolete systems that can’t be fixed
Legacy debt in its purest form is systems that are still running but no longer supported.
Once support ends, every new vulnerability becomes permanent.
There’s no smart workaround that makes an unsupported system “safe”. At best, you’re managing risk until you can replace it.
What to check in your audit:
Identify anything past support: server operating systems, appliances, hypervisors, and line-of-business apps
Flag systems that rely on exceptions (old protocols, weak authentication, special firewall rules)
Highlight anything that’s both business-critical and unsupported
Risk #3: “It still works” servers with neglected basics
This is the sneakiest one, because it looks completely normal.
The server is supported. The hardware runs fine. No one’s complaining.
But underneath, the basics have drifted.
Patching is inconsistent. Unnecessary services are still running. Permissions have crept wider over time. Backups exist, but no one’s proven they actually work when it counts.
These are the kinds of gaps that turn small issues into bigger outages.
What to check in your audit:
Patch reality: how current are you, and how often do updates slip?
Service sprawl: what’s running that doesn’t need to be?
Accounts and access: where are the shared credentials or overly broad permissions?
Backup confidence: when was the last restore test, and did it actually succeed?
Change control: who can make changes, and how are they tracked?
Stop Carrying Silent Risk
Legacy debt doesn’t make noise.
It sits quietly in the background until the day it turns into downtime, exposure, or an upgrade you’re forced to rush.
A legacy debt audit gives you control back.
It turns “we should deal with that someday” into a short, practical list you can actually act on.
Start with the highest-risk areas:
End-of-support edge devices
Obsolete systems that can’t be patched
Servers where the basics have drifted
Then assign owners, set dates, and work through them one at a time, moving each item from “too risky to touch” to “sorted”.
If you need a hand running a legacy debt audit or figuring out where to start, get in touch.
