--- title: Legacy Security Risks can be Mitigated description: As Microsoft withdraws support for Windows 7,8, and 8.1, millions of devices now present major legacy security risks. image: https://www.morphisec.com/hubfs/shutterstock_643713286.jpg --- Recent Webinar: Building an Adaptive Cyber Resilient Cloud ![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) ![arrow-white](https://www.morphisec.com/hubfs/arrow-white.svg) [![Watch now](https://no-cache.hubspot.com/cta/default/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/6359793e-b232-4b79-9da5-b929fc3dc7aa) ![close](https://www.morphisec.com/hubfs/close.svg) ![search_icon](https://www.morphisec.com/hubfs/search_icon.svg) [![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com) ![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360) [![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3) [![Morphisec-Logo](https://www.morphisec.com/hubfs/Morphisec-Logo.svg "Morphisec-Logo")](http://www.morphisec.com) ![search_icon](https://www.morphisec.com/hubfs/search_icon.svg) - ![blog](https://www.morphisec.com/hubfs/blog.svg) [![Read the Blog](https://no-cache.hubspot.com/cta/default/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/3c83d6d5-0c56-47b7-8aee-ae6edf73c360) - [![Get A Demo](https://no-cache.hubspot.com/cta/default/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/d4f17ebf-d8a2-49c3-9bca-a8f8112b45f3) Cybersecurity Blog Cybersecurity News, Threat Research, and more from the Team Spearheading the Evolution of Endpoint Security # How Secure are Your Legacy Systems? Posted by [Michael Gorelik](https://1534169.hs-sites.com/author/michael-gorelik) on January 12, 2023 Find me on: [LinkedIn](https://www.linkedin.com/in/michael-gorelik-56130021) [Twitter ](https://twitter.com/smgoreli) - [Tweet](https://twitter.com/share) As of January 10th 2023, [Windows 7](https://learn.microsoft.com/en-us/lifecycle/products/windows-7), [Windows 8, 8.1,](https://support.microsoft.com/en-us/windows/windows-8-1-support-will-end-on-january-10-2023-3cfd4cde-f611-496a-8057-923fba401e93) their Windows embedded derivatives, and [Windows Server 2008 R2](https://learn.microsoft.com/en-us/lifecycle/products/windows-server-2008-r2) will no longer receive patches from Microsoft. Millions of devices will now become "legacy" and create a suite of new legacy security risks.   [![Legacy Systems Webinar](https://no-cache.hubspot.com/cta/default/1534169/92a0ffe4-4371-43cf-b5f9-1fe25e0f0822.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/92a0ffe4-4371-43cf-b5f9-1fe25e0f0822) ## Windows 7 Life Support Ends, and 8/8.1 is Cut Loose  Microsoft's [2023-Jan Release Notes](https://msrc.microsoft.com/update-guide/) included their final patches for three of Microsoft's operating systems (OS): 7, 8, and 8.1. This move is unsurprising but may still catch many IT teams off guard.  ![Secure Windows Legacy System for Business](https://www.morphisec.com/hubfs/windows%20legacy%20system%20on%20a%20laptop.jpeg)For example, although Windows 7 entered its end-of-life (EOL) phase almost three years ago, Microsoft offered business users an add-on support package called an Extended Security Update (ESU).   This "pay for patch" offering allowed organizations running Windows 7 to receive critical patches while they migrated their systems to newer OS versions.  Now Extended Security Updates for these operating systems are officially gone, without the possibility of extended support.  As Windows 7, 8, and 8.1 and the embedded derivatives lose support, [another ~15 percent](https://gs.statcounter.com/os-version-market-share/windows/desktop/worldwide) of all Windows computers currently in operation (as per statistics from November 2022) will now no longer receive OS patches.   ![Manual Legacy System Update Button](https://www.morphisec.com/hubfs/Manual%20Legacy%20System%20Update%20Button.jpeg) ## Legacy Operating Systems Increase Risk Across the Software Supply Chain  Without vendor support, devices running EOL and non-supported operating systems become a continuous source of exploitable vulnerabilities.   In 2021, for example, [over 17 percent](https://www.edgescan.com/2022-vulnerability-statistics-report-lp/) of newly discovered vulnerabilities were over five years old.   Threat actors can also work back from vulnerabilities found in current OS versions to find new ways of compromising older machines. But more attackers actually wait for a patch to be released to develop [N-day exploits](https://www.trendmicro.com/zh_hk/ciso/21/k/n-day-exploit-protection-strategies.html#:~:text=An%20N%2Dday%20exploit%20is,patches%20from%20the%20compromised%20vendor.).  Due to the iterative nature of OS development, exploitable vulnerabilities that vendors discover and patch in newer versions of Windows OS systems are sometimes found in older versions—where they will never be officially fixed.   Legacy operating systems, and the applications that run on them, also lack modern access controls. This is a significant source of breach risk. According to Microsoft's research, [97 percent](https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/block-legacy-authentication) of successful credential stuffing attacks involve legacy authentication. Even worse, for businesses relying on Microsoft Defender to secure Windows 8 and 8.1, from January 10th Defender will no longer support these platforms.   ![Microsoft Defender Running on a Legacy System](https://www.morphisec.com/hubfs/ezgif.com-gif-maker(3).jpeg) CISA ranks relying on "unsupported (or end-of-life) software" in first place of [security bad practices](https://www.cisa.gov/stopransomware/bad-practices).  Even if an organization upgrades all its systems to Windows 10 or newer, it’s still statistically likely that legacy devices will pop up somewhere in the supply chain. So even if your organization doesn’t run EOL systems, your third- and nth-party suppliers likely do.  ## The Legacy Security Challenge  Microsoft's removal of patching support for Windows 7, 8, and 8.1, the end of support for Windows Server 2008 R2, and the expected end of support for [Windows Server 2012](https://learn.microsoft.com/en-us/lifecycle/announcements/windows-server-2012-r2-end-of-support) in October 2023 illustrates the headache EOL devices create.   Businesses relying on out-of-date applications and systems have been a reality for decades.   Industries like healthcare are notorious for relying on out-of-date systems. In 2019, news that the UK's healthcare system was still running thousands of Windows XP endpoints five years after XP patching ended shocked many but surprised few.  ![Vulnerable Legacy System Blue Screen Error](https://www.morphisec.com/hubfs/Legacy%20System%20Blue%20Screen%20Message.jpeg) In a 2022 survey conducted by the [SANS institute](https://www.sans.org/white-papers/state-ics-ot-cybersecurity-2022-beyond/), 54 percent of IT professionals working in OT and critical infrastructure organizations—including healthcare, said integrating and upgrading legacy systems was their biggest security challenge.   For many organizations in manufacturing, healthcare, finance, and education, taking legacy devices offline for upgrades is essentially impossible.   Another familiar challenge is that devices (such as an MRI machine workstation that runs on an out-of-date proprietary version of Windows) can hide EOL applications or prevent their replacement.   ## Hung Out to Dry  Removing support from Windows 7, 8, and 8.1 and Windows Server 2008 R2 shifts many more devices into this "never going to be replaced or patched" category.  Unfortunately, even if a legacy device has the compute to run security controls such as an antivirus system or EDR, and you can find a compatible protective solution, its scanners are extremely unlikely to be able to spot or stop modern evasive malware. This means countless organizations relying on legacy devices have a dangerously unsecure environment, which dramatically increases their exposure to attack.   ![Legacy System Network Compromised by Malware](https://www.morphisec.com/hubfs/Malware%20Comprised%20Network.jpeg) Machines running legacy operating systems are often part of the core operational backbone of an organization, running web servers, financial transactions, and other critical business applications—amplifying risk. Since Microsoft’s end of support included embedded operating systems, critical IoT and OT devices such as point of sale (POS) systems, ATMs, medical devices, and industrial control system endpoints are also exposed.   ## Can You Get Effective Legacy Security?  As any cybersecurity practitioner knows, securing legacy systems is a daunting challenge. Because they lack power compared to current systems, legacy systems need a lightweight security solution. They also need something that’s compatible with their software—both factors that rule out most of today’s industry leading security solutions such as EPP, EDR, and XDR/MDR. (Legacy systems lack basic mechanisms used by EDRs such as script scanning through AMSI.)  One solution that does offer ultra-lightweight protection and is compatible with Windows 7, 8, 8.1 and Windows 2008 R2 devices and servers is Morphisec. Morphisec Guard and Keep provide endpoint and server protection respectively for legacy environments and proactively prevent known and unknown advanced threats. Using patented, automated [Moving Target Defense (MTD)](https://www.morphisec.com/moving-target-defense) technology, Guard and Keep can run on a Raspberry Pi while preventing the most destructive cyberattacks, including supply chain attacks, zero-days, fileless/in-memory attacks, ransomware and other stealthy and evasive attacks. Gartner calls MTD “[transformative.](https://blog.morphisec.com/gartner-endpoint-protection-moving-target-defense)” To learn more about how to protect your legacy Windows (and Linux) systems with automated Moving Target Defense, [schedule a demo](https://www.morphisec.com/schedule) now. [![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/50832359-01e9-4911-98db-45bd66a69b90.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/50832359-01e9-4911-98db-45bd66a69b90) ### Subscribe to our blog Stay in the loop with industry insight, cyber security trends, and cyber attack information and company updates. [![New call-to-action](https://no-cache.hubspot.com/cta/default/1534169/e098d357-1710-4cfe-8901-19c93de122f4.png)](https://cta-redirect.hubspot.com/cta/redirect/1534169/e098d357-1710-4cfe-8901-19c93de122f4) ### Search Our Site ### Recent Posts ### Posts by Tag - [Automated Moving Target Defense (157)](https://1534169.hs-sites.com/topic/automated-moving-target-defense) - [Threat Research (135)](https://1534169.hs-sites.com/topic/threat-research) - [Cyber Security News (132)](https://1534169.hs-sites.com/topic/cyber-security-news) - [Morphisec Labs (127)](https://1534169.hs-sites.com/topic/morphisec-labs) - [Morphisec News (54)](https://1534169.hs-sites.com/topic/morphisec-news) - [Adaptive Exposure Management (14)](https://1534169.hs-sites.com/topic/adaptive-exposure-management) - [Defense-in-Depth (13)](https://1534169.hs-sites.com/topic/defense-in-depth) - [Ransomware (12)](https://1534169.hs-sites.com/topic/ransomware) - [Preemptive Security (11)](https://1534169.hs-sites.com/topic/preemptive-security) - [Gartner (10)](https://1534169.hs-sites.com/topic/gartner) - [Continuous Threat Exposure Management (CTEM) (9)](https://1534169.hs-sites.com/topic/continuous-threat-exposure-management-ctem) - [Microsoft (8)](https://1534169.hs-sites.com/topic/microsoft) - [In-Memory Attacks (7)](https://1534169.hs-sites.com/topic/in-memory-attacks) - [Healthcare Cybersecurity (6)](https://1534169.hs-sites.com/topic/healthcare-cybersecurity) - [Advanced Threat Defense (5)](https://1534169.hs-sites.com/topic/advanced-threat-defense) - [Financial Cybersecurity (5)](https://1534169.hs-sites.com/topic/financial-cybersecurity) - [Legacy Security (5)](https://1534169.hs-sites.com/topic/legacy-security) - [Artificial Intelligence (4)](https://1534169.hs-sites.com/topic/artificial-intelligence) - [Linux Cybersecurity (4)](https://1534169.hs-sites.com/topic/linux-cybersecurity) - [Fileless Malware (3)](https://1534169.hs-sites.com/topic/fileless-malware) - [Threat and Vulnerability Management (2)](https://1534169.hs-sites.com/topic/threat-and-vulnerability-management) - [Managed Service Providers (1)](https://1534169.hs-sites.com/topic/managed-service-providers) [See all](https://1534169.hs-sites.com/legacy-security-risks#) - [![X](https://1534169.hs-sites.com/hubfs/x_twitter_icon.svg)](https://twitter.com/morphisec) - [![Linkedin](https://1534169.hs-sites.com/hubfs/linkedin_icon.svg)](https://www.linkedin.com/company/morphisec) - [![Youtube](https://1534169.hs-sites.com/hubfs/youtube_icon.svg)](https://www.youtube.com/channel/UCe48cR5xTxPJSYMjG-So7Rw) © 2026 Morphisec Ltd. | All rights reserved ![iso27001-(2)](https://www.morphisec.com/hubfs/iso27001-(2).png) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Michael Gorelik", "url" : "https://1534169.hs-sites.com/author/michael-gorelik" }, "dateModified" : "2024-12-19T16:05:16.008Z", "datePublished" : "2023-01-12T15:37:45.000Z", "headline" : "Legacy Security Risks can be Mitigated", "image" : [ "https://www.morphisec.com/hubfs/shutterstock_643713286.jpg" ], "mainEntityOfPage" : { "@id" : "https://1534169.hs-sites.com/legacy-security-risks", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.morphisec.com/hubfs/morphisec-logo-color-horz.png" }, "name" : "Morphisec" } } ```