How to improve resiliency in legacy IT environments
Older technology cannot be swapped out quickly due to costs and complexity, but organizations can strengthen recovery capabilities while modernization efforts continue.
Resiliency has become a top priority in IT operations -- and with good reason, as cyberattacks, outages and other disruptions continue to test how well an organization can recover from them.
For CIOs and disaster recovery leaders, the challenge goes beyond maintaining aging systems. Legacy infrastructure can slow recovery, increase operational risk and complicate modernization efforts meant to improve resilience and help drive business growth. Many organizations stick with their legacy systems because they support important business processes and are typically either too expensive or too difficult to replace. As a result, resilience projects usually focus on reducing risk and improving recovery capabilities, while modernization takes place over time.
This balancing act grows more difficult as cyberthreats and other disruptions constantly test an organization's ability to recover. A September 2025 Cohesity survey of 3,200 IT and security operations decision-makers found 76% had experienced at least one material cyberattack, while only 47% felt completely confident in their ability to withstand today's threats. One reason many organizations lack confidence in their ability to recover data, systems and services is their legacy infrastructure.
"Historically, legacy environments were designed for availability, not resilience, and they lack the flexibility, visibility and automation needed to recover quickly when there is a disruptive event," said Tom Gould, director of cyber-risk remediation and enterprise resilience at consultancy West Monroe.
Even if an organization backs up all its data, there's a high likelihood that a full recovery will take time in an older environment, Gould explained. These delays could make an organization wait longer for systems to be back online and for the IT services needed to run the business to become operational again.
"Legacy infrastructure, with its tightly coupled systems, undocumented dependencies and unsupported applications, has really become a liability," Gould added.
Why legacy infrastructure is such a risk to resiliency
There are multiple reasons why legacy infrastructure is so problematic, experts said.
As Gould noted, it is typically riddled with undocumented dependencies and out-of-support systems. IT teams often lack in-house skills to maintain older technology. It can also be difficult to find or afford outside experts to do that. This becomes particularly detrimental during a crisis, when having the right expertise is essential for recovery work.
Kishore Bitra, a member of the Emerging Trends Working Group at the ISACA professional association, said that modern data technologies, processes and security approaches often don't work well with legacy infrastructure.
"Those things make it very hard to restore and meet objectives and metrics for recovery," said Bitra, who is also senior systems engineer at IT services company Tabner Inc. and collaboration engineering leader for the city of Baltimore's IT department.
At the same time, many organizations are accumulating legacy tech faster than ever. The reason? Technology evolves so quickly that existing infrastructure becomes obsolete much sooner, said Rajeev Khanna, CIO of Trucordia, an insurance brokerage based in Lindon, Utah.
"Legacy doesn't need to be 20 or 25 years old," Khanna said. "Even businesses that have only been around for 10 or 15 years have accumulated legacy, because tech is moving so quickly. Now, even technology that's a year or two old can become legacy."
How to address resiliency shortcomings
Given how quickly technology goes from cutting-edge to legacy, CIOs and other execs need to assess their organization's IT environment and understand where legacy infrastructure limits resilience, Khanna said.
"They need to ask, 'Can I withstand disruption to the data, to application services?'" Gould said, adding most organizations with legacy infrastructure cannot answer "yes."
While legacy infrastructure cannot always be replaced immediately, experts said organizations can reduce their risk and improve resiliency by following these practices.
- Start with an inventory. "Know what you have," said Hakan Kantas, principal advisor for operational resilience at LumaTech Advisory and another member of the ISACA Emerging Trends Working Group. "You cannot improve resiliency or modernize your infrastructure if you don't have an inventory of systems, data and dependencies."
- Recognize the business risk. "Understand how you're impacted by tech debt and legacy services and systems. And understand the organization's risk tolerance for its legacy applications," Gould said.
- Prioritize resiliency improvements. Assess the components that present the greatest risk to the business, Gould said. Use business risks, needs and strategic objectives to determine whether infrastructure should be transformed, modernized, rationalized or isolated.
- Bundle initiatives. Bitra suggested combining resiliency improvements with transformation initiatives and other IT-driven projects. This can help IT leaders get the support and resources required to do the actual improvement work, he said.
- Aim for incremental improvements. "Don't wait for the perfect modernization project," Kantas said. "The goal isn't to completely eliminate legacy; the goal is to understand the risk, manage it and continuously improve it."
- Measure progress using business metrics. "In the end, resilience isn't measured by how modern your technology is," Kantas said. "It is measured by the reduction of risk of financial loss to the organization and how well you can recover when something goes wrong." As a result, organizations should track metrics such as data availability and system downtime costs.
Mary K. Pratt is an award-winning freelance journalist specializing in enterprise IT, cybersecurity strategy and data management.
