Cyber Resilience Act (CRA): Europe’s cybersecurity framework for digital products

Legacy Systems in Industrial Plants: The Challenge of Protecting Protocols That Were Never Designed to Be Secure

10 de September de 2026

An industrial plant is nothing like a data center. While an office server is replaced every three or four years, a PLC, variable frequency drive, or remote station may have been controlling the same process for fifteen, twenty, or even thirty years. That longevity is, to a large extent, the reason why plants work: industrial assets were designed to last, not to be updated. But it is also the source of one of the most persistent problems in OT cybersecurity today: how to protect equipment and protocols that were conceived at a time when no one expected them to be connected to a network, let alone the internet.

This article examines why legacy systems remain the weakest point in industrial cybersecurity, why the traditional response of “installing an agent” does not work in most of these environments, and which architectural approaches can reduce risk without touching the asset that needs to be protected.

What Do We Mean by a “Legacy System” in an Industrial Environment?

In the OT context, “legacy” does not simply mean “old.” It refers to a set of characteristics that, when combined, create a risk profile very different from that of a conventional IT system:

Hardware with limited resources, designed to execute the control process in real time and nothing else.
Discontinued operating systems or firmware versions that the manufacturer stopped supporting years ago.
Communication protocols —Modbus, Profinet, S7, DNP3, IEC 104, BACnet— designed between the 1970s and 1990s for closed and physically isolated networks.
Functional safety certifications that prevent software or hardware from being modified without repeating lengthy and costly certification processes.
Replacement cycles measured in decades, determined by the service life of the physical machinery with which they are associated.

The result is an installed base of assets that continues to operate —often perfectly reliably from a functional standpoint— but that was designed at a time when cybersecurity simply was not part of the requirements.

Protocols Without Authentication or Encryption: The Underlying Problem

The technical root of the problem lies in the industrial protocols themselves. Modbus, one of the most widely used protocols in manufacturing, energy, and water, was designed for fully controlled environments and does not incorporate any authentication mechanism. Knowing an IP address and a function code is enough to establish a session and read or write registers. Protocols such as Profinet or S7 share similar limitations in their classic versions: they were designed for a world of “implicit trust,” in which any device speaking the protocol was considered legitimate by definition.

That implicit trust made sense when industrial networks were physically isolated from everything else. The problem emerged with IT/OT convergence: digitalization, remote maintenance, and integration with enterprise management systems connected those same networks —and those same unauthenticated protocols— to much more exposed environments. More secure evolutions, such as secure Modbus/TCP, already exist, but their adoption is slow precisely because they require upgrading equipment that, in many cases, cannot be upgraded.

Why Installing an Agent Is Not an Option

Faced with this type of risk, the instinctive response of an IT security team is to install an agent: an EDR, a remote access client, or a monitoring probe. In the OT world, that response runs into several barriers that are not optional:

Insufficient resources. Many controllers and RTUs do not have spare CPU, memory, or storage capacity to run an additional process without compromising control of the physical process they manage.

Closed real-time operating systems. A significant percentage of legacy assets run on proprietary firmware or RTOS platforms that do not allow third-party software to be installed, much less an agent requiring elevated privileges.

Functional safety certifications. In processes that affect the physical safety of people or facilities, any modification to installed software can invalidate the system’s certification and require certification processes lasting several months to be repeated.

End of manufacturer support. When an ICS vendor stops supporting a platform version, the system often remains in production —sometimes for years— but there is no longer a legitimate channel through which agents or patches can be deployed.

Operational risk of the intervention itself. An active vulnerability scan designed for IT can itself block or degrade sensitive OT equipment; the cost of a production shutdown to “secure” the system may exceed the cost of the risk the organization intended to mitigate.

The practical consequence is that a large proportion of the industrial installed base worldwide is, and will remain for years, incompatible with AI agents. Any cybersecurity strategy that depends on deploying software directly on the asset excludes, by design, a substantial part of the attack surface that needs to be protected.

The Cost of Leaving the Problem Unresolved

This is not a theoretical problem. Manufacturing has been the most attacked sector globally for five consecutive years according to the IBM X-Force index, and in 2025 it accounted for 27.7% of all recorded cyberattacks. Dragos, in its annual OT cybersecurity report, documented 3,300 industrial organizations affected by ransomware in 2025 —up from 1,693 in 2024— and 119 ransomware groups actively targeting the industrial sector, 49% more than the previous year. In Spain, the manufacturing and industrial sector accounted for more than 34% of ransomware incidents in 2025, according to ESED, driven precisely by these environments’ low tolerance for any downtime.

One figure from Dragos is particularly relevant to the issue at hand: the most common cause of network compromise in the industrial incidents analyzed was not an exotic vulnerability or a zero-day exploit, but access through remote access portals and virtualization services —VPNs, firewall interfaces, vendor tunnels—. In other words, the most common point of entry is not the legacy PLC itself, but the door someone left open in order to reach it without physically traveling to the plant.

This connects two problems that are often addressed separately: the inability to install agents on legacy assets, and the growing need for internal technicians and external vendors to access those same assets remotely for maintenance, support, or monitoring. The more remote users interact with a system that cannot defend itself, the greater the exposure surface becomes.

The Reference Framework: What the Standards Say

There is no need to start from scratch. Established frameworks specifically address this problem, although their practical implementation in plants with a large legacy installed base remains complex:

IEC 62443 is the international reference standard for cybersecurity in industrial automation and control systems. It introduces the concept of zones and conduits: a zone groups assets with common security requirements, while a conduit is the communication channel between zones, which must be protected to the level of the most demanding zone it connects. It also defines security levels (SL-1 to SL-4) according to the capability and motivation of the attacker against whom protection is required.

The Purdue Model (or Purdue Enterprise Reference Architecture), developed in the 1990s and adopted as a conceptual foundation by IEC 62443 itself, organizes the industrial network into hierarchical levels —from the field level (sensors and actuators) to the corporate network— with a demilitarized zone (DMZ) between the OT and IT levels. CISA and NIST SP 800-82 continue to recommend it as a reference for establishing clear trust boundaries, although they acknowledge its limitations when applied to more dynamic architectures based on IIoT or cloud technologies.

At the regulatory level, the NIS2 Directive (EU 2022/2555), in force since October 2024, significantly expands risk management and incident reporting obligations for operators of essential services, including a substantial part of the industrial sector. In Spain, the National Security Framework (ENS) and the CCN-STIC guidelines issued by the National Cryptologic Centre translate these principles —segmentation, access control, traceability— into practical requirements for public administrations and the infrastructures that depend on them.

None of these frameworks requires, nor could realistically require, an agent to be installed on every PLC from 1998. What they require is communication control, effective segmentation, and traceability of who accesses what. Security is built into the network and the access layer, not into the legacy device itself.

Mitigation Strategies That Do Not Require Touching the Asset

Based on this framework, industrial organizations have several options available that do not depend on modifying the legacy system:

Network segmentation through zones and conduits. Physically or logically separating the plant network from the corporate network, with firewalls or access control lists between each level of the Purdue Model, limits lateral movement in the event of a compromise.
Passive traffic monitoring. Asset discovery and traffic analysis tools that do not send active frames to devices provide visibility —inventory, firmware versions, unexpected communications— without the risk associated with directly querying fragile equipment.
Industrial protocol-aware firewalls. Devices capable of inspecting Modbus, S7, or Profinet at the function level can block unauthorized write commands even when the protocol itself lacks authentication.
DMZ between IT and OT. Any data flow that needs to leave the plant network for corporate systems should pass through an intermediate zone, ideally using unidirectional flow (data diode) or a controlled protocol proxy.
Protocol gateways and access virtualization. When a legacy device must expose its interface to a technician —locally or remotely— without installing anything on the device itself, control shifts to the access layer: who connects, from where, for how long, and with what level of privilege.

This last point is, in practice, where much of the challenge lies. If remote access is the most common entry vector according to incident data itself, the way that access is managed —and not merely the protection of the technician’s endpoint— becomes the most decisive control.

The Question That Remains Open

Segmentation, passive monitoring, and protocol filtering substantially reduce risk, but they leave one question not entirely resolved: how can an organization ensure that remote access to a legacy asset —essential for day-to-day maintenance— does not itself become the point of entry? A VPN encrypts the channel, but if the technician’s device is compromised, that compromise can propagate to the asset because the endpoint still has direct access to it through the tunnel.

This is where an approach different from traditional remote access comes into play.

Endurance: Isolating the Asset, Not Just Encrypting the Channel

Cosmikal, a Spanish technology manufacturer, develops Endurance, a Remote Shielded Workspace (RSW) platform that integrates PAM, VDI, IAM, and DLP capabilities. Unlike the VPN model, in which a compromised endpoint can ultimately affect the asset because it maintains direct access to it through the channel, Endurance isolates the asset from both the endpoint and the network: in addition to encrypting the connection, it introduces an air gap between the device from which the technician connects and the industrial system being accessed. The asset is never directly exposed to an endpoint that the organization does not fully control.

This architecture is particularly relevant to the problem described in this article: because control is applied at the access layer rather than on the device itself, Endurance makes it possible to protect legacy systems that do not support AI agents, without having to install anything on the PLC, HMI, or engineering workstation that needs to be maintained. This makes Endurance a practical way to extend the segmentation and access control principles of IEC 62443 all the way to the final link in the chain —the legacy asset on which no agent can be installed— without compromising its functional safety certification or operational availability.

Endurance is included in the CPSTIC catalogue thanks to its certifications —including LINCE under its PAM taxonomy— supporting its suitability for use in critical infrastructures and Spanish public administrations. In a threat landscape where remote access has become the most common compromise vector targeting the industrial sector, ensuring that such access never directly reaches the asset is no longer an option; it becomes a competitive advantage.