The UK's cybersecurity watchdog has sounded the alarm on a threat lurking in plain sight: outdated technology. This isn't just about slow computers; it's a critical national security risk. So what exactly has the NCSC so concerned?
Defining the 'Older Systems' Problem
When the National Cyber
Security Centre (NCSC) talks about 'older digital systems', it refers to technology that is often called 'legacy'. These are systems, software, and hardware that are still in use but are no longer supported by their original manufacturers. This means they don't receive crucial security updates, patches, or technical support. Think of operating systems that have reached their 'end-of-life', internet-connected factory equipment running on decades-old software, or critical business applications that haven't been modernised. While they may still function, they are frozen in time from a security perspective, lacking the defences needed to counter modern cyber threats. The NCSC's latest 'State of the Cyber Nation' report, published November 3, 2026, highlights that many organisations are managing complex estates riddled with this kind of technical debt.
The Core Dangers Highlighted
The primary danger is that these old systems are rife with known vulnerabilities that will never be fixed. Hackers are well aware of these weaknesses and actively seek them out. The NCSC warns that the rise of Artificial Intelligence is acting as a 'force multiplier' for attackers, allowing them to discover and exploit these longstanding flaws at a speed and scale that was previously unimaginable. According to the NCSC's Chief Executive, Richard Horne, the issue isn't that AI is creating new types of attacks, but that it's making it far easier to weaponise old vulnerabilities. This increases the risk of successful ransomware attacks, data theft, and operational disruption. The report specifically warns that an AI-powered ransomware attack on the UK's critical national infrastructure is 'highly likely' by 2028.
An Era of 'Tech on the Cheap'
If these systems are so risky, why do they persist? The NCSC points to a culture of 'tech on the cheap', where organisations have prioritised cost-saving over security investment for years. Migrating away from a legacy system that is deeply embedded in a company's operations can be incredibly complex, expensive, and time-consuming. Business leaders may adopt an 'if it ain't broke, don't fix it' mentality, especially if the system appears to be working correctly. However, the NCSC argues this is a dangerous miscalculation. Horne warned that leaders who continue to neglect cybersecurity spending and run obsolete systems will have to answer for the consequences when essential services fail, from food not being on shelves to the lights going out.
Critical Infrastructure on High Alert
The NCSC's warning is particularly aimed at operators of Critical National Infrastructure (CNI), which includes sectors like electricity, water, transport, and communications. These are the services that underpin society, and the use of older operational technology makes them a soft target. Horne cited a recent, non-AI example in France where attackers compromised outdated, internet-connected refrigeration systems in supermarkets, causing food to spoil. The NCSC found similar vulnerabilities in the UK and had to work urgently to alert the affected organisations. The report stresses that with digital technology now controlling physical processes, the potential for a cyberattack to cause realworld harm is immense. The report identifies statesponsored actors, particularly from China, as having the capability and intent to target UK critical infrastructure.
The NCSC's Urgent Call to Action
The report is not just a diagnosis of the problem; it's an urgent call for investment in resilience. The NCSC is urging all UK organisations, from public institutions to private businesses, to take immediate action. The key recommendations are not revolutionary but focus on mastering the fundamentals of good cybersecurity. This includes applying software updates promptly, improving security monitoring, strengthening access controls, and developing robust incident response plans. For leaders, the message is clear: review your outdated systems and invest in modernisation now. The agency is pushing for a shift in mindset, where security is no longer seen as an IT cost but as a core business enabler essential for survival in an increasingly hostile digital world.
