Still Supported Isn't the Same as Still Safe: Legacy Assets and the Enforcement Gap

No ratings

Presented at BSides Bristol 2026 by

Mateusz Madrzynski

Organisations keep running insecure legacy systems not because they don't know about the risk, but because replacing them costs more than they can afford. And even when a system is supported and the patch is free, there are laws and guidelines saying you must update but actually enforcing that across every system in a large organisation is a different problem entirely. This talk uses real incidents to show both failure modes, and ends with three things you can actually do about it this week.