Many agencies still run mission-critical workloads on legacy systems that are now **decades old**—some, like those at the **Department of Education** and **Department of Health and Human Services**, are **almost 50 years old**. A 2019 Government Accountability Office report labeled these systems a **high security risk**.

As vendor support ends and technology ages, these systems become:

• Hard to update and patch – making it easier for attackers to exploit known vulnerabilities.
• Stiff and unadaptable – federal employees in the The Legacy Liability poll described their legacy IT as inflexible and in need of investment before it compromises security.
• Operationally risky – a successful attack could disrupt power and critical services, affecting hospitals, banks, gas pumps, military installations, and cell phone networks.

More than **two out of five** poll respondents said outdated IT infrastructure is their **biggest security hurdle**, underscoring that legacy environments are no longer just an IT problem—they are an enterprise risk issue.

Legacy infrastructure makes it harder for agencies to support secure remote work and to get full value from cloud investments.

From the Government Business Council poll:

• **More than two out of five** respondents cited outdated IT as their top security challenge.
• **41%** specifically linked outdated infrastructure to **remote work security risks**.

As agencies shift workloads to the cloud to gain agility, support remote work, and meet compliance needs, many still describe their security posture as static. In fact, **44%** of respondents said their security infrastructure is **static even in the cloud**.

The core issue isn’t just the cloud itself, but how it’s managed:

• Organizations often fail to **continuously validate** that security controls, segmentation, and other protections are working as intended.
• Without this validation, gaps and overlaps in security controls go unnoticed, leaving remote workers and cloud workloads exposed.

To reimagine security for hybrid and remote environments, agencies need to pair cloud adoption with modern security practices that keep pace with constant change.

Agencies are beginning to rethink their approach to legacy systems and security by focusing on modernization, cloud migration, and continuous validation of controls.

Key steps include:

• Prioritize modernization of high‑risk legacy systems
  Use risk assessments (like the GAO’s findings on 50‑year‑old systems) to identify which platforms pose the greatest security and mission risk, and target those first for upgrade or replacement.
• Move appropriate workloads to the cloud
  Cloud can enable **agility**, **remote work**, and **compliance**, but only if security is designed in from the start. Three quarters of poll respondents said **cloud security funding is essential** for a modernized workforce, highlighting the need to budget for security alongside migration.
• Adopt security instrumentation and continuous validation
  Security experts from FireEye emphasize the need to **prove security effectiveness**. That means using tools and processes that continuously test whether controls, segmentation, and policies are actually working, and then closing identified gaps.
• Extend traditional security to cloud environments
  Effective cloud security still requires:
  • Network, endpoint, and email security
  • Comprehensive visibility across environments
  • Continuous compliance and governance to detect and stop elusive threats quickly
• Address resource and skills constraints
  Many agencies lack the IT staff to deliver essential security. This makes partnerships, managed services, and automation important levers to keep pace with evolving threats while modernizing legacy systems.

By combining modernization, cloud adoption, and continuous security validation, agencies can reshape their legacy environments into more resilient, adaptable infrastructures that better support their missions.