Vulnerability management for legacy systems is the practice of finding, scoring, and reducing risk on hardware and software that no longer receives vendor patches, with the goal of keeping unsupported assets from becoming the easiest way into the network in 2026. Legacy and end-of-life (EOL) systems break the standard playbook because there's no patch to apply — every fix has to come from segmentation, virtual patching, or a documented exception instead of a vendor update.
- Vulnerability management for legacy systems replaces patching with segmentation, virtual patching, and tracked exceptions once vendor support ends.
- CVSS severity alone misleads on EOL systems — pair it with EPSS exploit-probability scoring and CISA's KEV list before triaging.
- A documented, reviewed risk exception beats a silent 'risk accepted' note when SOC 2 or HIPAA auditors ask for evidence.
- Brinqa's exposure management platform treats legacy assets as a distinct risk category instead of losing them in a generic patch queue.
- Segmenting a legacy server from the rest of the network cuts blast radius even when the underlying CVE stays unpatched.
Why this matters for legacy and EOL systems
Legacy and EOL systems usually run the applications a business can't swap out on short notice — ERP modules, mainframe interfaces, custom line-of-business software built for an operating system nobody sells support for anymore. A generic vulnerability scanner still throws a CVSS 9.8 finding at that box, but the ticket's remediation field says "patch not available," and the finding sits open for years because the standard SLA assumes a fix exists.
Auditors don't accept "it's old" as a control. SOC 2, HIPAA, and PCI DSS reviewers expect a documented exception with compensating controls and a review date, not a blanket risk-acceptance memo from 2021. Platforms like Brinqa treat legacy exposure as its own risk category rather than a subset of "systems the team hasn't gotten to yet," which matters because legacy assets often disappear from agent-based inventories entirely — the same problem teams running hybrid IT environments hit when cloud and on-prem inventories don't line up.
Inventory every legacy and end-of-life asset first
You can't manage what isn't on the list, and legacy systems are the assets most likely to fall out of agent-based counts.
- Pull asset data from the CMDB, network scanners, and cloud consoles — not just EDR agent totals
- Flag operating systems and applications past their vendor-published end-of-support date
- Cross-reference firmware and appliance versions; network gear and OT devices go EOL too
- Note which legacy assets touch regulated data so exceptions get prioritized correctly
- Re-run the inventory quarterly — new systems age into the EOL category every year
Map compensating controls where a patch will never ship
Once vendor support ends, "wait for the patch" stops being an option — the control has to replace the fix permanently.
- Document segmentation, firewall rules, or VLAN isolation around each legacy asset
- Apply virtual patching or IPS signatures at the network layer for known CVEs on the system
- Restrict administrative access to a named, logged list of accounts
- Disable services and ports the legacy application doesn't actually need
- Record each compensating control against the specific CVE it offsets, not as a general note
Segment legacy systems from the rest of the network
A flat network turns one unpatchable EOL server into a route to everything connected to it.
- Move legacy and EOL assets into a dedicated VLAN or subnet with explicit allow-list rules
- Block outbound internet access from legacy systems that don't require it
- Require jump-box access for any admin session into a segmented legacy asset
- Alert on any new connection attempt into or out of the legacy segment
- Test the segmentation with a scan from outside the boundary, not just a firewall rule review
Prioritize by exploitability, not just CVSS severity
A CVSS 9.8 with no internet exposure and no exploit code in the wild is a different risk than a CVSS 7.5 under active attack. Manually, that means pulling EPSS scores and CISA's Known Exploited Vulnerabilities catalog yourself and joining them to scanner output by hand. An exposure management platform like Brinqa correlates CVSS, EPSS, KEV status, and asset criticality automatically, so legacy findings surface by real risk instead of raw severity count.
- Pull EPSS scores alongside CVSS to see which findings carry real exploit probability
- Cross-reference the CISA KEV catalog for anything actively weaponized
- Weight asset criticality and data sensitivity into the score, not severity alone
- Reprioritize legacy findings monthly since EPSS shifts as exploit activity changes
Build a risk exception process for systems you can't remediate
Every legacy asset that can't be patched needs a documented, reviewed exception — not a silent "risk accepted" note buried in a spreadsheet. Build it on a formal vulnerability risk exception process instead of an ad hoc approval.
- Require business-owner sign-off on each exception, not security-team-only approval
- Set a mandatory review date, typically 90 days, never an indefinite exception
- Attach the compensating controls in place to the exception record
- Route exceptions through the workflow auditors will actually ask to see
- Escalate exceptions past their review date automatically instead of letting them expire quietly
Monitor legacy systems continuously, not on a scan cycle
A quarterly scan window misses the weeks between scans when a new exploit for an EOL product starts circulating.
- Feed legacy asset logs into a SIEM or log aggregator for real-time alerting
- Watch for anomalous outbound connections, often the first sign of compromise on a legacy box
- Subscribe to vendor and CISA advisories for the specific EOL products still running
- Re-scan legacy segments after any network change, not just on the standard schedule
Report legacy risk to the board in business terms
Executives don't need a CVE list. They need to know which unpatchable systems could stop the business and what replacing them costs in time.
- Frame legacy risk as "systems with no vendor fix available," not raw vulnerability counts
- Tie each legacy asset to the business process it supports
- Show exception aging — how many exceptions sit past their review date
- Include a replacement or migration timeline for the highest-risk legacy assets, even a multi-year one
See legacy risk in one view
Correlate CVSS, EPSS, and KEV data across legacy and modern assets together.
Options for managing legacy and EOL vulnerability risk
| Option | Best for | Key limitation |
|---|---|---|
| Spreadsheet + manual tracking | A handful of legacy assets | Doesn't scale and has no automatic EPSS or KEV updates |
| Generic vulnerability scanner | Baseline CVE detection on legacy OS versions | Flags severity with no exploit context or exception tracking |
| Brinqa exposure management platform | Teams managing legacy risk alongside cloud and on-prem assets | Needs upfront integration with CMDB and scanner data |
| Managed security service provider | Teams with no in-house capacity to monitor legacy segments | Less control over prioritization logic and exception workflow |
Common mistakes with legacy and EOL vulnerability management
- Accepting legacy risk once and never reviewing it again, letting a 2023 exception still sit open in 2026
- Running aggressive authenticated scans against fragile legacy systems and crashing production processes
- Judging legacy findings by CVSS score alone, missing that a lower-severity CVE is on the CISA KEV list
- Leaving compensating controls undocumented, which fails audits even when the control itself works
- Deprioritizing EOL systems because they don't show up in an EDR-based asset count, undercounting real exposure
The systems most likely to get you breached in 2026 aren't the ones missing this month's patch — they're the ones that stopped getting patches years ago.
FAQ
What counts as a legacy or end-of-life system in vulnerability management?
A legacy or EOL system is any hardware or software past its vendor's published end-of-support date, meaning no more security patches ship for it. Windows Server 2012 (EOL October 2023) and Windows 7 (EOL January 2020) are common examples still found in production networks.
Is patching even possible for end-of-life systems?
No — once vendor support ends, no new patches are released for that product. Risk reduction has to come from segmentation, virtual patching at the network layer, or migrating off the system entirely.
How do you scan legacy systems without crashing them?
Use unauthenticated or passive scanning where possible and schedule active scans during low-traffic windows. Fragile legacy systems can crash under authenticated scans that modern hardware handles without issue.
Should legacy systems get the same CVSS-based SLA as modern systems?
No — a CVSS-only SLA assumes a patch exists to close the finding, which isn't true for EOL systems. Pair CVSS with EPSS and CISA KEV status to set remediation priority based on real exploit likelihood instead.
What is a virtual patch and does it replace a vendor patch?
A virtual patch is a network-layer control, usually an IPS or WAF signature, that blocks exploit traffic for a known CVE without touching the vulnerable software itself. It reduces exposure but doesn't remove the underlying flaw the way a vendor patch would.
How often should a legacy system risk exception be reviewed?
Every 90 days is standard practice for documented exceptions on unpatchable systems. Indefinite exceptions with no review date are what compliance auditors flag first.
Can compliance frameworks like SOC 2 or HIPAA accept legacy systems as an exception?
Yes, but only with a documented exception that names the compensating controls and a review date — auditors reject blanket risk-acceptance statements with no supporting evidence.
What's the difference between legacy and EOL systems?
Legacy generally means old but still supported in some form, while end-of-life means the vendor has formally stopped issuing security updates. Some vendors sell extended support programs after the EOL date, which delays the migration decision without eliminating it.
One last thing
Extended security update programs exist for some EOL products, and they feel like a fix — they're a countdown, not a solution. Buying an extra year of patches without setting a hard migration deadline just moves the same decision to 2027 with a bigger legacy footprint attached to it.
