Follow us

A variety of legacy Systems are an open door to Cyber criminals

It’s true to say that that with the exception of new start-up’s, most businesses have legacy systems to manage. This can be for a multitude of reasons:

Firstly, these may be systems inherited and are thus considered, rightly or wrongly, too low risk and therefore not imperative to upgrade; couple that with the cost to upgrade and potential upheaval associated with that, makes the removal of legacy systems an unappealing option.

In a recent InfoWorld article it stated that there was a “lack of attention to legacy systems where as much as 80% of business data is stored…”

Considering recent challenges that businesses have faced, knowing that 80% of valuable business assets are at potential risk is startling, and acknowledging that these vulnerabilities could potentially leave that open door to cyber criminals is the start to addressing how to protect your assets.

If these business systems, that we so heavily rely on, are in fact neglected in terms of cyber security – particularly if you have a lack of clarity on your controls, as well as budgetary and human resources constraints – this is creating a perfect storm that could threaten the very heart of your organisation.

Consider this – how would your business cope under cyber-attack?

We know this is a question that keeps CISO’s and CIO’s up at night, but the challenges they have faced over recent years have presented and accentuated the issue even more – are your systems resilient?

With so much changing, is your business at greater risk of a Cyber Attack?

Many organisations cyber efforts have focused primarily on customer facing activities, meaning ‘back doors’ into your business are being left open. However, legacy systems are easy to neglect when they are seemingly working so efficiently.

The Verizon 2021 Data Breach Investigation Report found that 80% of cyber attacks gained access via issues with ID’s and passwords, a seemingly simple way to access business data. So now it is even more important than ever to focus your efforts to help protect and control employee engagement and supply-chain partner access to all your key systems via log in and interfaces.

The QO View: Protecting your legacy systems to protect your security posture.

1. Ensure you have total Board focus and budget support

This is the top priority – demonstrating that legacy systems are a potential threat by demonstrating the gaps in your controls and processes are the first imperative step. You must have senior buy-in in to accomplish any of the steps we recommend.

2. Obtain visibility of your assets and the data it holds

Does it hold data and how valuable is it to your business?  Understanding how it interacts with other systems is vital in knowing the scale of the potential risks. Also, do have a complete understanding of where all of your legacy systems are? Is there an inventory of them?

3. Explore what can be redesigned

What systems can be redesigned and improved in order to protect your security posture? This could be as simple as testing and upgrading components to supported versions. You may be challenged on this if it is an exercise previously tried before, however, sometimes with the right focus from the right person, this can be executed with high success.

Another avenue to explore is the move to the cloud; potentially this can be more timesaving in the long run, but challenging in an environment with budgetary constraints.

4. Isolate legacy kit and restrict access control

This is often not ideal for legacy solutions. However, by providing a controlled “front door” access, often through VDI or some kind of proxied solution and ensuring “back door” access via controlled PAM solutions (CyberArk etc.), will strengthen protection.

5. Where you can – patch and secure

Again, not always possible with old solutions, but where you know you can, consider implementing a test or pre-production system to test and assess risk for the environment.

6. Retain the staff and supply chain that maintain your legacy kit

Have you looked around your team lately and noticed anything?

As business leaders it is very easy to oversee the people that just “get on” with their jobs. People that have perhaps been there for some time, but we just don’t have time to check in with.

We are not suggesting that this is a deliberate act – we all do it – but what we may be missing is the fact that those people may be bored, suffering from alert fatigue, and possibly thinking about leaving and the only thing that might be keeping them there is the apathy to leave and a solid pay cheque – not positives if you want to get the most out of your team.

However, this does not mean that you should not act to retain these team members – don’t forget they have the knowledge, they know the legacy systems, and this is invaluable.

So consider how they can help you in protecting these systems WITH them, not only because they have the knowledge, but by engaging with them and challenging them to support you with solutions.  This will not only make their day-to-day job far more interesting, but will also help you secure your environment.

Also consider engaging with some graduates who could support you in figuring all the legacy operations out, this will not only remove some of the risks of only a few understanding the legacy equipment in place, but mixing experience with youth can often create incredible results.

There’s one more thing you may want to consider….

Monitoring your cyber environment with Continuous Controls Monitoring

Multiple platforms, multiple compliance frameworks – legacy systems are a potential amalgamation of the perfect storm that truly only helps the cyber criminals that want to infiltrate your business.

You may think your legacy kit is low risk, so you don’t feel any action is needed. But truly – how confident are you of that?

Are you monitoring all of your platforms and systems? We don’t mean taking a snapshot in time, but truly monitoring them, continuously so that you have the ultimate truth in your security posture, because if you are not, then you need to consider how you create the security around the perimeters of your business.

Consider these questions:

  1. How do you know all of these things you depend on are working properly?
  2. Has anyone changed anything that may have opened the door to criminals and placed you at higher risk?

How does Continuous Controls Monitoring answer these questions?

  • CCM can monitor any of your data, which includes any legacy systems you may have.
  • Real-time, 24/7, accurate monitoring of your controls and compliance to provide you with a single source of truth
  • Operational efficiency – alleviating the pressures from your teams
  • Providing risk quantification – gather the data you need to understand your risk.

Essentially combining of all of these things, attempting to lock down systems and implement continuous controls monitoring will bring cohesion and security to your cyber environment and ensure continued compliance.

Want to find out more about the benefits of CCM? Take a look a look at a recent infographic


Contact Us

To find out more about cyber security and Continuous Controls Monitoring, please complete the form below with a short message and we’ll get right back to you. Alternatively, you can book a meeting directly.

2nd & 3rd Floor,
2 Burgon Street,
City Of London,


Niall Flavin

DevOps Engineer -

Uttamkurmar Lakhani

Technical Analyst -

Register for updates

Please register your contact details with us to receive links to insightful blog articles as soon as they are published.

2nd & 3rd Floor,
2 Burgon Street,
City Of London,


Liam Flavin

Intern Developer -

Ekaterina Kuzevanova

Back End Developer -

Mohamed Mohamud

Front End Developer -

Juan Morales

DevOps Engineer -

Luke Bakare

DevOps Engineer -

Rutvik Belapurkar

Technical Analyst -

Harman Singh Malhotra

Technical Analyst -

Jason Wilkes

Technical Lead -

Annie Greenfield

Marketing Executive -

Will Tonge

Head of Recruitment -

Will has spent the last 9-years embedded in Cyber Security working with global, household names and innovative start-ups.

Passionate about bringing people and technology together, Will has worked in various settings, helping build high-growth organisations across multiple sectors. During this time, he has built an extensive network with access to some of the best talent out there.

Outside of QO, his young daughter keeps him well on his toes!

Shaun Barnes

DevOps Team Lead

Mark Hudson

Non-Exec Director -

Mark works with SMEs and charities to develop strategies to help them grow and access development capital. He is a NED, charity trustee and mentor to a wide range of people. His plural career started in 2017 after 16 years at pwc as a Deals partner working with large corporates and PE houses; at pwc he also ran the Retail and Consumer practice and was Chairman of the pwc UK Supervisory Board. Prior to pwc he was an executive director at Welcome Break and Iceland Group, and a partner at Bain and Company. He trained as an engineer at Imperial College and has an MBA from INSEAD. 

Register for our event

Sign-up to future Quod Orbis events

Eamon Flavin

Non-Exec Director -

Eamon is a highly regarded and massively respected technology career professional as well as serial entrepreneur. He has started, grown and successfully taken to market three technology business.

Genuinely expert in technology, Eamon has enjoyed long-term working relationships with many of the world’s top companies and organisations in finance, banking, government, manufacturing, engineering, technology and the charities sector.

He draws on unparalleled contacts and experience and provides advice, solutions and recommendations, as well as helping respond to emergencies. Eamon has grown in-house and client teams and has a gift for hiring great people.

Peter Martin

Non-Exec Director -

Peter has the ability to do what many fail to and that is to consistently bring together highly professional teams and build a business environment that is supportive, agile, professional and where everyone enjoys coming into the office.

Bringing a unique blend of business acumen and technical knowledge to the role of non-exec director, Peter has already demonstrated his ability to bring an exceptional flair for dealing with complex situations with a clear, considered approach.

Personally, Peter brings humility and a strong moral compass to the team. His disarming and self-deprecating approach wins everyone over.

Anwen Haynes

Head of Marketing -

Anwen has worked in B2B and B2C marketing for over 20 years. From transforming end-to-end customer journeys in retail with strategic customer-centric plans to target driven focused strategies for B2B sales. With extensive experience in digital marketing including SEO, as well as Brand development, she loves to develop a cohesive approach to brand image and communications to drive and develop the business proposition and perception.

Alice Walker

Head of Customer Success -

Alice has worked in the IT industry for 20 years. Starting in Procurement, she moved into Software Asset Management before transitioning into Customer Success Management. Working across a variety of roles for different industries as both a customer and a service provider has given her a great understanding of what makes a great service. She has always been passionate about building and maintaining great customer relationships and helping her customers achieve their goals.

Owain Rowley

Lead Developer -

Owain has spent nearly a decade building software solutions and products within the cyber security sphere for the likes of government entities, large telecommunication companies, banks and card transaction companies.

This level of experience allows him to swiftly identify business and security processes that can be streamlined with automation, increase the efficiency of existing processes, as well as generate insightful data visualisations and models for members of an organisation at each different level.

Ami Penolver

Head of HR & Legal -

Ami is a finance sector career professional, with many years’ experience working in financial services, both in London and throughout the UK. In addition to financial control, she looks after HR and legal for the company.

Being a mother of two also equips her with the basic skills required to manage a senior team of management and technology consultants.

Ami’s sense of balance and perspective is an essential ingredient of the Quod Orbis culture.

Alastair Dickson

Commercial Director -

Alastair has spent the last 20 years working in Cyber Security and Risk Management. He is a passionate believer that security solutions should enable a business to take advantage of all the benefits of the digital world, while not putting the organisation’s data or productivity at risk.

Alastair has developed high-performing teams in some of the industry’s most competitive markets and launched new innovative technologies to market.

Being a rugby coach, and also having four sons at home, means he has lots of experience in keeping a passionate team in order but always has time for some fun!

Gary Penolver


Gary has 15 years’ experience in senior technology roles, and has already been closely involved in starting and taking two technology companies to market.

Totally comfortable with a fast-moving, state-of-the-art technical landscape, he helps his clients maintain and improve security and compliance.

He has a reputation for delivering pragmatic and easy to maintain solutions – business owners and managers enjoy knowing that the security and compliance is well managed and automated, properly instrumented and reported at a competitive cost point.

Honest, open, unflappable and very social, Gary is trusted by many household-name organisations to protect their, and their client’s data.

Martin Greenfield


Martin is an experienced technology and organisational transformation specialist and an excellent, proven leader and communicator in mission-critical operations, particularly in security technology.

Over the past 20 years, multi-billion pound commercial organisations, including global banks, utilities and major investment funds have trusted Martin to transform their operations to meet financial, operational and compliance targets.

Martin optimises operations, managing and transforming operational teams of between 50 and 500 people, to deliver the highest levels of audit compliance, risk management and financial efficiency.

Often working with other major consultancies and suppliers for new global corporate owners or management teams, Martin will help integrate and streamline operations on a global basis.

Thank you.

Please register your contact details with us to receive links to insightful blog articles as soon as they are published.

Sign Up!

Fill in your details to access the Liberty & QO White Paper

Request a Quod Orbis CCM demo

Contact us to schedule a demo of the Quod Orbis CCM managed platform.

See it for yourself – automated Continuous Controls Monitoring (CCM), with complete cyber controls visibility in a single pane of glass, continuance compliance, automated audits, our unique service wrap, and more.

Please complete your details and a member of the Quod Orbis team will be in touch soon.