Three things changed in 2026 that make legacy technology your risk

The conversation changed while everyone was looking at AI

Every public sector executive in Australia is under pressure to show progress on artificial intelligence (AI). Fewer are asked the harder question: what is all of this being built on? Beneath the new services, dashboards and AI pilots sit systems that are 40 and 50 years old. They hold citizens' personal and medical information. They move payments. They underpin services the country cannot operate without.

Public sector leaders have been having a version of this conversation for decades, usually within the technology function and usually without a decision. What has changed is how many different authorities are now raising it at once, and how little room they have left to keep deferring.

The evidence has been accumulating jurisdiction by jurisdiction, and now across sectors. Three things changed in 2026: the strategic policy community entered the debate, audit findings hardened into national mandates, and the threat environment accelerated beyond what ageing systems can absorb:

• South Australia's Auditor-General has examined what legacy systems cost state agencies.
• Western Australia's information systems audits have flagged unsupported technology year after year, now paired with a mandated modernisation pathway.
• The Australian National Audit Office has pointed to ageing systems behind national payments and services.
• The Australian Signals Directorate (ASD) last published executive guidance publicly on managing the risks of legacy information technology (IT) in April 2024, updated that June, addressed to government executives rather than to their technology teams, and the Protective Security Policy Framework turned 'legacy' from a judgement call into a definition.
• In June 2026, the Enhanced Critical Infrastructure Risk Management Program Rules began treating unsupported technology as a material risk for specified high-risk assets, with compliance required from June 2027. [1][2]
• In July 2026, a different kind of voice joined them: the Australian Strategic Policy Institute (ASPI), a strategic policy think tank rather than an auditor or a regulator, put end-of-life technology on the national resilience ledger, as accumulated strategic risk rather than a maintenance backlog.

That change in who is speaking matters as much as what is being said. When auditors raise legacy technology, it reads as compliance. When regulators raise it, it reads as obligation. When the policy community raises it, it becomes a question of national capability, and the audience shifts from the chief information officer to the cabinet table.

ASPI's diagnosis is the one worth considering carefully. The problem is that organisations both fail to communicate the risk in terms of real-world failures and fail to use that information to force a decision to take action. Most decisions are to 'kick the can down the road', a decision but not the right or courageous one. ASPI's account of why points to accountability that has been divided until it has effectively dissolved: operators, boards, procurement teams, regulators and ministers each hold a portion of the problem, and none holds the decision. Systems nobody has owned for years go on carrying critical information long after the final security patch. [5] Sitting underneath all of it is an AI-accelerated threat environment that has collapsed the time available to act.

A decades-old conversation has now acquired a deadline. This is a leadership risk that has been mistaken for a technical one.

You cannot charge ahead with new tools and AI without getting the basics right, nor while the foundations are falling down around your ears.

What it actually costs to keep the lights on

The uncomfortable part is not that these systems are old. It's the increasing cost and time to keep them on life support, diverting resources from spending on modern digital services.

South Australia's Auditor-General reviewed legacy information and communications technology (ICT) across 18 agencies in 2025. Vendor maintenance and support alone ran to at least $20 million a year, and legacy persisted precisely because replacement was judged 'too costly, risky or difficult'. The pattern is not local. The United Kingdom's National Audit Office found that roughly £2.3 billion of £4.7 billion in annual government IT spend goes to keeping legacy running. The United States Government Accountability Office puts around 80% of federal IT spend into operations and maintenance.

That is not prudence. Every dollar spent holding a decades-old platform together is a dollar of lost opportunity to give Australians better, safer and more useful services. ASD states the economics plainly: it is always less costly to mitigate the risks of legacy IT before a major cyber security incident occurs.

At the same time, the risk is compounding. ASPI found that the median time to exploit a newly disclosed vulnerability has fallen from 63 days to as little as 5, and that nearly 40% of the most actively targeted vulnerabilities affect end-of-life devices. [4][5] For systems that will never receive another patch, there is no remediation window at all. There is only exposure. The coming transition to post-quantum cryptography will exacerbate the problem, particularly for systems that cannot be upgraded at all.

The Commonwealth Cyber Security Posture report found that 59% of federal entities said legacy technology was preventing them from reaching Maturity Level 2 of the Essential Eight. [6] Meanwhile the pool of people who understand these systems keeps shrinking, through retirement, undocumented changes, and business rules that now exist only in the heads of people about to leave. New Jersey's public appeal for COBOL programmers to rescue 40-year-old mainframes is the version of this story that made the news. Most versions do not.

Why the risk never reaches the people who could fund it

This is also where the problem stalls. Chief technology officers cannot get the chief information officer's attention, chief information officers cannot get the chief executive's attention, and without top-down drive neither the funding nor the will ever arrives. South Australia's Auditor-General documented the mechanics of that failure: incomplete asset inventories, limited formal risk assessment, gaps in risk registers and inconsistent reporting to governance committees. Legacy risk is treated as a compliance exercise and often not escalated at all, and when it does reach the top it arrives as a footnote inside a cyber security paper.

The contrast with regulated industry is stark. Australian prudential standards make boards accountable for operational risk oversight and require entities to monitor the age and health of their information assets. In banking, insurance and superannuation, the age of a system is a board-reportable metric. In much of government, it is not measured at all.

Which leads to the question executives are rarely required to answer. Not 'what does success look like?' but 'what happens if we don't do this?' Unglamorous legacy work competes for the same limited funding as new, visible initiatives, and it loses. The business case for modernisation is written as an IT proposal, while business cases for new initiatives are written as public value. A genuine risk-based approach would instead compare every initiative on the same footing and require an articulation of the consequences of failure for people, communities and society. Framed that way, legacy stops being a technical imperative championed by the IT crowd and becomes what it is: a potential public service failure that needs deliberate investment to remediate and prevent.

There is a way through, and it is not a big bang

There are, in fact, well-proven patterns to effectively deal with legacy incrementally and safely, and none of them require a single large-scale replacement program.

The 'strangler fig' approach, which Thoughtworks has documented in detail across its modernisation work, carves decoupled functionality out of the old system, rebuilds it, and migrates piece by piece (moving house one room at a time) until the original can be safely switched off. The same staged logic can be applied to legacy data: find where it lives, assign owners, clean and govern it, then build towards a future state where data is used to inform decisions.

Singapore offers proof that the incremental approach is possible. GovTech's Singpass digital identity platform, a Thoughtworks engagement since 2017, was modernised incrementally rather than being replaced, and now carries more than 500 million transactions a year for 5 million residents. That staged flexibility is what allowed it to absorb national contact tracing at an average of 9 million check-ins a day during the pandemic, a demand nobody had designed for.

'We cannot take it offline' is the objection that needs to be addressed

There is a serious objection to all of this, and it comes from the people closest to these systems. Some services have no maintenance window. A trade, border or payments platform that stops for a minute can cost millions, and it is needed around the clock. From that perspective, refusing to touch the system is not timidity. It is the rational position of leaders whose accountability is continuity. Modernisation advice that skips past this loses the room immediately.

Continuity is precisely why modernisation should happen in slices. Incremental change allows risks to be mitigated and overall risk to be reduced. The patterns described above exist for exactly this situation: they run old and new side by side, migrate a piece at a time, and maintain a way back. Careful prioritisation determines what parts of a system can be changed safely while protecting services. This is therefore not a question technology leadership can answer alone, because the trade-off belongs to whoever owns the service.

From there, the discipline is to work in small slices. A well-framed problem and a theory about its root cause (we believe that if we change this, we will get a better that) provides a good starting point. Delivering discrete pieces of value rather than pursuing large-scale transformation reduces the chance of fixing the wrong thing, and allows the program to absorb new information as it emerges. Small steps lead to small wins, and those small wins compound into progress that can be demonstrated.

Two things separate the programs that work from the ones that stall. The first is a courageous executive, who does not need to have all the answers, but does need to champion the right things and bring in partners willing to deliver actual outcomes rather than activity. The second is designing for what comes after. Modernisation that does not embed continuous improvement, continuous funding and measurement against objective outcomes simply schedules the same conversation for 5 or 10 years' time.

The authority to begin is already in the room

The evidence that this can be funded and governed already exists. Western Australia's Digital Capability Fund has received more than $1.3 billion and has approved part or full funding for 102 projects, created specifically to address legacy systems posing significant service delivery risk. [3] The fund exists because the risk was named, owned and costed, which is the same sequence any agency needs to follow.

There is light at the end of the tunnel, and it is closer than the scale of the problem suggests. Staged delivery makes it possible to demonstrate visible value inside an election cycle, making this a politically survivable decision as well as a responsible one.

Move the risk appetite away from zero, fund modernisation with a meaningful proportion of effort, time and money rather than whatever is left over, and take the first step. You are less alone in this than it feels. The only genuinely expensive option left is to keep deferring.

About this article

This article was developed collaboratively by subject matter experts from Thoughtworks and Public Sector Network. It brings together Thoughtworks’ experience modernising critical systems with PSN’s understanding of the challenges facing public sector leaders across Australia and New Zealand. The analysis reflects a shared view that legacy modernisation is not simply a technology upgrade, but a leadership imperative requiring clear ownership, incremental delivery, continuous investment and a sustained focus on public outcomes.

References

1. Cyber and Infrastructure Security Centre, The enhanced critical infrastructure risk management program: a snapshot, June 2026. https://www.cisc.gov.au/resources-subsite/Documents/enhanced-cirmp-implementation-factsheet.pdf
2. Security of Critical Infrastructure Legislation Amendment (Enhanced Critical Infrastructure Risk Management Program) Rules 2026 (LIN 26/075), s 8A(2)(b). https://www.legislation.gov.au/F2026L00701/asmade/2026-06-09/text/original/epub/OEBPS/document_1/document_1.html
3. Office of the Auditor General Western Australia, 2025 Transparency Report: Major IT Projects, 16 June 2025. https://audit.wa.gov.au/reports-and-publications/reports/2025-transparency-report-major-it-projects/
4. Australian Strategic Policy Institute, Past its use-by date: turning end-of-life technology risk into national advantage, 2026. https://www.aspi.org.au/report/past-its-use-by-date-turning-end-of-life-technology-risk-into-national-advantage/
5. Jason Van der Schyff and James Corera, 'Legacy technology is a national security threat hiding in plain sight', The Strategist, 28 July 2026. https://www.aspistrategist.org.au/legacy-technology-is-a-national-security-threat-hiding-in-plain-sight/
6. Department of Home Affairs, Commonwealth Cyber Security Posture Report, February 2026.